Adding a new filter
About this task
To add a new filter In the Filters panel, follow this
procedure:
- Give a name to the filter.
- Decide if you want to set either of the options on the Standard tab:
- Show events by severity
- Set this to select that the filter includes only specific types of message
- Show correlated log records only
- Select this if you are using a correlation, and want the filter to include only messages that are correlated. See Comparing log files for more details about correlations.
- Click the Advanced tab.
- Click Add to add a new filter expression. Note that you can make complex filters by creating an unlimited number of filter expressions.
- On the Add Filter Property window, select a property and an operator, and enter the value or partial value for the property to filter for. Wildcards can be used for the partial value. These expressions are saved automatically and permanently in the Add Filter Property window when you click OK.
- Click OK to close the Edit Filter window.
- If the Add/Edit/Remove Filters window is open, click OK to close it.
- The new filter is applied immediately. If you have a complex filter or many records, you might have to wait for the results to be visible.
For example, creating a filter expression selecting the Message Text property with "=" (equals), and supplying a value of *JOBMON*, and then creating a second filter expression selecting the Creation time property with ">" (greater than), and supplying a value of 2008-02-08 21:53:16.38+0100 creates a filter that, when you apply it, displays only messages containing the string "JOBMON" created after the indicated date.