Global Filters

Global filters are classified as Public Filters. Global filters are processed at the Collector Manager sequentially for each event until a match is found. Global filter evaluation stops for that event and the matched global filter action is taken for that event. The order of evaluation of global filters is top to bottom, as shown in the Console. They can be enabled or disabled as needed.

Global filters do the following:

Through the Global Configuration window, you can:

image\ebx_1500297255.gif

To Create a Global Filter:

  1. Click the Admin tab.

  2. Click Admin > Global Filter Configuration or select Global Filter Configuration in the navigation tree.

  3. In the Global Configuration window, click Add.

  4. In the new blank row, click Filter Name column.

  5. Select a filter and click Select or Add (if you need to create a filter).

  6. In the Active column, click Active box.

  7. In the Action column, select the action that the global filter will have on events that pass this global filter. If an event does not meet any of the active global filters, then the default action determines how the event is handled.

You can set the Default Action box to one of the following:

  1. Continue adding filters until you are finished.

  2. Click Save.

To Rearrange Global Filters:

  1. In the Global Configuration window, Select a filter and click Up or Down to move it to a different location on the list.

  2. Click Save.

NOTE: When deleting a Global Filter, you will not get a confirmation message.

To delete a global filter:

  1. In the Global Configuration window, Select a filter from the list and click Delete.

  2. Click Save.