cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
986
Views
0
Helpful
1
Replies

Filtering Multiple Auth Users in SawMill

Scott H
Level 1
Level 1

I am unable to generate a report with more than a single person. The only attributes I am applying is:

Statistics for 01/Jun/2010 - 30/Jun/2010, 30 days 
Report is filtered and shows data for
  Action is NOT: TCP_DENIED
  Auth User is: local\lcl4034@ntlm, local\scott@ntlm (<<These are applied as "Wildcard Expression")

With a single user, I can generate a report without issue but the second I add another user the report is blank. At this point it is all or just 1. I know I have sucessfully done this in the past but now it is not working.

1 Reply 1

allscott
Level 1
Level 1

Easiest way is to add more indivudal items per field type query rather than trying to build a more complex argument within a single element.

For example:

Hope this helps

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: