Previous Topic: Set a ProfileNext Topic: Configure Global Query Settings

Administration Guide › Filters and Profiles › Create a Global Filter

Create a Global Filter

You can create a global filter. Global filters let you view all queries and reports, or all incidents using the same qualifying factors. When you create a global filter you choose whether it applies to events or to incidents. A single global filter cannot apply to both. You can also use the Global filter interface to set application-wide query settings.

To create a global filter

  1. Click the Global Filters button at the top of the main window.

    The Global Filters and Settings dialog appears.

  2. Click the Events tab or the Incidents tab to select where you want the global filter applied.
  3. Specify the time period you want your filter to search, using the Time Range drop-down list.
  4. Select the Match check box to enter a specific value by which you want to filter all available raw events.

    Note: You can search for multiple values, phrases, or partial values in the raw events by using the specialized Match syntax.

  5. Click Add Filter to specify event fields that you want to include in the filter.

    The Column drop-down menu and Value entry field appear.

  6. Choose the event field you want to include in the filter, and type the value that the field must have to be displayed in the filtered reports. You can enter multiple event field names and values by clicking Add Filter again. Selecting the Exclude button includes every value but the one you enter for the chosen event field name.

    Note: If you create a global filter on a string-type field, it is added to the Quick filters list. If you create a filter on a numeric or time field, it is added to the Advanced filters list.

  7. (Optional) Click the Advanced Filters tab to add additional complex qualifiers.
  8. (Optional) Click the Settings tab to choose and global settings. These setting are applied to the whole application.
  9. (Optional) Select Set as Default at the bottom of the dialog to retain the filter settings for any future sessions, as long as you are logged in as the same user.
  10. Click Save.

    The Global Filters and Settings dialog closes, and the new filter is applied to reports.

More information:

Using Advanced Filters