Can't seem to add more than 3 filters in Smart Log

[Joe_Kanaszka]

Hey all - 

I'm trying to dynamically add filters in Smart Log to filter some traffic.  I'll right click on an entry and the service I'm filtering and click "add to filter" & "OR NOT snmp", and so on...until I reach the 4th filter. 

It doesn't filter...

So in this example:

NOT service:https OR NOT service:domain-udp OR NOT service:igmp OR NOT service:snmp

So in the above filter, traffic with snmp as a service is still showing.

Any ideas?

[the_rock]

Hey brother,

Are you saying that filter does NOT work?

Andy

[garrod]

Hi,

Open TAC case or RFE, this command is not working in my R81.20 as well, Enhancement required for R&D Team

They able to work with

source:1.1.1.1 NOT destination:2.2.2.2 NOT destination: 3.3.3.3

or

source:1.1.1.1 OR destination:2.2.2.2 OR destination: 3.3.3.3

combing NOT and OR will not work

[the_rock]

That makes sense. I will confirm in my lab as well.

Andy

[JozkoMrkvicka · Accepted solution]

Try this syntax (including brackets):

NOT (service:https OR service:domain-udp OR service:igmp OR service:snmp)

[G_W_Albrecht]

Right, same as my versions above - everything except service1, service 2. service3, service4

[the_rock]

Thats it!

[Joe_Kanaszka]

This works -

Thank you Jozko!

[G_W_Albrecht]

Logically, OR does not make any sense here: NOT service1 is everything except service1, including service2. NOT service2 includes service1, but not service2.

So either use:

NOT service:https AND NOT service:domain-udp AND NOT service:tunnel_test AND NOT service:igmp

When you use queries with more than one criteria value, an AND is implied automatically, so there is no need to add it.

NOT service:https NOT service:domain-udp NOT service:tunnel_test NOT service:igmp