I'm trying to build some Views for Bluecoat ProxySG logs. I want to filter on the site category, the Category field in the parsed log entry. As an example, I can see in a summary that I have the following categories represented in the log:
The double quotes in the second example are present in the Details display and are present in drill-down results in Views.
When I filter on the first version (the one with the underscore) I get the expected results. I have yet to find any way to filter on the second variant of the Category and get any results returned. I have tried:
I know that there are events present because I can enter a specific host, get the events returned, and the Category is shown as "Online Storage" so the events are there, I just cannot isolate them.
Am I missing something obvious?