Administration Guide › Queries and Reports › How to Create a Query › Set Query Filters › Create an Advanced Event Filter

Create an Advanced Event Filter

Advanced filters are used by many features, including query creation, report scheduling,alert jobs, and local and global filters.

To create an advanced filter

1. If you are creating a scheduled report job or action alert job, click the Events or Incidents tab to set the appropriate filter type. Since a report or alert job may contain both event and incident queries, you can set the filter types separately.
2. Click New Event Filter.

   The first row of the event filter table becomes active, and its Logic and Operator columns are populated with the default values "And" and "Equal to" respectively.

3. Click the Logic cell and change the logic value as needed.
4. Click the Column cell, and select the event information column you want from the drop-down menu.
5. Click the Operator cell, and select the operator you want from the drop-down menu.
6. Click the Value cell, and enter the value you want.
7. (Optional) Click the open and closed parentheses cells and enter the number of parentheses you need.
8. (Optional) Repeat steps 1 through 6 as needed to add additional filter statements.
9. Click Save when you have entered all the filter statements you want.

More information:

Create a Simple Event Filter

Using Advanced Filters