Smartlog Query Syntaxes

[Ryan_Ryan]

Hi all,

can someone advise how I can get the most out of smartlog query bar, In smartview tracker I could add  a source filter for example: 172.16.0.0/12 in smart log i can add src:172.16.* but that is not good for specific subnet masks.

The other thing I miss is being able to add a filter for any non empty field, ie src:172.16.0.0/12 AND source username NOT blank

thanks!

[Tal_Paz-Fridman]

Hi Ryan

You can refer to the Online Help which includes several examples:

https://sc1.checkpoint.com/documents/R80.30/SmartConsole_OLH/EN/html_frameset.htm?topic=zfFmGvPiAIUa...

It is also included in the Logging and Monitoring R80.30 Administration Guide:

https://sc1.checkpoint.com/documents/R80.30/WebAdminGuides/EN/CP_R80.30_LoggingAndMonitoring_AdminGu...

HTH

Tal

[Ryan_Ryan]

Thanks, unfortunately then it seems impossible as the documentation only shows suffixing with an asterisk.

I would have thought be able to search for a specific network would have been a fairly common requirement!

[Matthias_Kring]

As to the Networl 172.16.0.0/12, you can create a Network Object for this. Then use the Network object as query item.

For example:

[Dror_Aharony]

Hi Ryan,

Searching for subnet suffix is possible, just as you wrote:

Try: src:172.16.0.0/12  or src:172.16.0.0/16

*I'll check the documentation.

Regarding Non-empty values, searching with * should work.

Try field:* (src_user_name:*)

[Ryan_Ryan]

thank you!!