Filters can be specified in many places in the software, and you can filter on any item or value in your log files. If you use the same filter often you can save the details of the filter by clicking the Save button, and Open it in the future whereever you need to use it.
You can apply a filter to your log files on import into the Storage, on an analysis in Summaries, on a Report, globally for the entire report, or individually for selected nodes within the report.
Filters can be defined on the Filters page of the Import, Analysis or Report Wizards, or the Template Node dialog within a report template. There is a Graphical Filter Editor, and a Manual Expression. The Graphical Filter Editor should cover 99% of what you wish to filter, so we recommend to always use this to define your filters.
To specify a filter click the Add button then select the type of filter you want. Most of the options in the dropdown relate to Date and/or Time filters. If you wish to filter on anything other than date or time, select the Field Value Filter option.
Field Value Filter
The Field Value filter allows you to report on any field in your log files, or in the schema that the report template is based on. This is the filter to use if you want to report on just a single user, or a few users, or just a single Department; or if you want to include only a specific site in your report; or exclude a group or category of sites, such as Advertising hits.
To do this, click Add | Field Value Filter, then choose the summary that you would like to filter on, eg Usernames. If you have defined an alias for this summary, then select it from the Alias dropdown, eg Usernames. This will populate the list below with the groups from your alias. Then select whether you want to Include or Exclude the items, and then check the box(es) for the items you want to use in the filter (eg the specific user(s) you want to include).
If you haven't defined an alias, leave the alias dropdown as No Alias; then select whether you want to Include or Exclude the items, and then click Add and type in the item you want to filter on, exactly as it's shown in the log files/report/summaries. Eg write the username as DOMAIN\UserID. If you want to add another item, click add again, and enter it.
It's recommended not to use the Display Known button, as this can take some time to generate the list of items, depending on the size of your storage. If you are not sure of the syntax of the item you want to filter on, the best way to find out is to run an analysis in Summaries and look at the full table for that summary. You can even copy the item's value from here, and paste it into your filter.
The Date filter option will allow you to specify a date range (from; to) which to include in the report. The range is inclusive, so both the From and the To dates will also be included in the report.
Relative Date Filter
The Relative Date filter option will allow you to specify a time period relative to the day the report is generated. For example, you could run a report for the past 1 Month, or the last 7 Days. You can enter the value into the text box, and select the period from the dropdown option.
The period selected will always be the last completed period, for example if you select Show Past 1 Month, and run the report on March 14th, the report will include all of February. If you also wish to include the current, incomplete, period in the report check the "Include current period" checkbox. The report will then include all of February, plus the 1st - 14th March.
Day Of Week Filter
The Day Of Week filter option allows you to specify certain days of the week to include in the report. You can select the days individually, or select the Weekdays or Weekends checkboxes to select a group of days.
Time Of Day Filter
The Time Of Day filter allows you to specify certain times to include in the report. You can left click on the 0 - 24 bar and highlight the period you would like to include. You can also right-click on this bar and drag to unselect a specific period. Or you can use the Add button to enter a time range you wish to include in the report, and this can be as specific as a per second value.