Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
fadijoueidi
Explorer

R80.40 Smartlog : Edit Chart filter -> rule filter

Hello, 

I am currently generating some reports and I have to add a filter on a chart and not on the whole document.

I need to filter the chart on a rule but I am not able to find the good value for the following field. 

03be428a-df21-4ac5-9f18-2d16fa9d88f7.png

When I choose "access rule name" and I put the name it doesn't work.

Does it also work with layer rules ?

Thank you in advance for your help.

0 Kudos
9 Replies
PhoneBoy
Admin
Admin

Did you try putting the value in quotes?

0 Kudos
fadijoueidi
Explorer

Yes, with "" and '' .

I also tried with rule "UID" 'UID' but nothing

0 Kudos
PhoneBoy
Admin
Admin

What precise rule(s) are you trying to get the name of?
What blades are active in that policy?
I suspect it's because the relevant log entries are not indexed.

0 Kudos
Amir_Senn
Employee
Employee

You entered a rule number and it didn't filter properly?

Are you using JHF? I think we had some issue with those field which were fixed for R80.40 in the JHF.

Kind regards, Amir Senn
0 Kudos
fadijoueidi
Explorer

@PhoneBoy 

I have a specific rule (network and application) name and I would like to add a chart in a report with the output of this rule.

@Amir_Senn 

I did with the name, UID and it did not work. 

It says "no data found" but when I click on the rule I can see hit counts and logs on the logs pane.

Capture.PNG

The version of the SmartEvent is R80.40 JHF 83.

0 Kudos
PhoneBoy
Admin
Admin

There have been several GA JHF since then, the most recent one being 154, and there are several SmartEvent fixes.
If the issue still exists after upgrading to the latest GA JHF, open a TAC case. 

0 Kudos
Amir_Senn
Employee
Employee

For rule number with internal layer try * after the number.

For example, rule name with inter layer is 5, try Rule Equals 5*

Kind regards, Amir Senn
0 Kudos
fadijoueidi
Explorer

Hello, 

Thanks for your answer !

The issue is that I have multiple policy packages so it will not be relevant if I enter a rule number.

Kind regards,

0 Kudos
Amir_Senn
Employee
Employee

From tests in my lab if you do rule number with * it would be relevant only if the other policies has inline layer as well, and if they have this could be solved by adding another filter "Policy Name" Equals "<Policy Name>".

Kind regards, Amir Senn
0 Kudos