Filtering Multiple Auth Users in SawMill

Unanswered Question
Jul 8th, 2010

I am unable to generate a report with more than a single person. The only attributes I am applying is:

Statistics for 01/Jun/2010 - 30/Jun/2010, 30 days 
Report is filtered and shows data for
  Action is NOT: TCP_DENIED
  Auth User is: local\lcl4034@ntlm, local\scott@ntlm (<<These are applied as "Wildcard Expression")

With a single user, I can generate a report without issue but the second I add another user the report is blank. At this point it is all or just 1. I know I have sucessfully done this in the past but now it is not working.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
allscott Fri, 07/09/2010 - 07:15

Easiest way is to add more indivudal items per field type query rather than trying to build a more complex argument within a single element.

For example:

Hope this helps

Actions

This Discussion

Related Content