0 Replies Latest reply on Jul 25, 2013 6:05 PM by acommons

    Filtering with values that are quoted strings

    acommons

      Hi,

       

      I'm trying to build some Views for Bluecoat ProxySG logs. I want to filter on the site category, the Category field in the parsed log entry. As an example, I can see in a summary that I have the following categories represented in the log:

       

      Online_Storage

      "Online Storage"

       

      The double quotes in the second example are present in the Details display and are present in drill-down results in Views.

       

      When I filter on the first version (the one with the underscore) I get the expected results. I have yet to find any way to filter on the second variant of the Category and get any results returned. I have tried:

       

      • String with quotes as returned in the Category
      • String without quotes
      • String with escaped quotes - \"
      • String with double double quotes - ""
      • String in a variable
      • String in a Watchlist - well I tried to create a watchlist but I can't create one of type Category.

       

      I know that there are events present because I can enter a specific host, get the events returned, and the Category is shown as "Online Storage" so the events are there, I just cannot isolate them.

       

      Am I missing something obvious?

       

      Cheers,

      Andrew