Compound Event View Constraints
Compound constraints are based on all non-count values for a
specific event. When you select a row with multiple non-count values, you set a
compound constraint that retrieves only events matching all the non-count
values in that row on that page. For example, if you select a row that has a
source IP address of
10.10.31.17 and a
destination IP address of
10.10.31.15 and a
row that has a source IP address of
172.10.10.17 and a
destination IP address of
172.10.10.15, you
retrieve all of the following:
-
Events that have a source IP address of 10.10.31.17 AND a destination IP address of 10.10.31.15
OR
-
Events that have a source IP address of 172.10.31.17 AND a destination IP address of 172.10.31.15
When you combine compound constraints with simple constraints,
the simple constraints are distributed across each set of compound constraints.
If, for example, you added a simple constraint for a protocol value of
tcp to the compound
constraints listed above, you retrieve all of the following:
-
Events that have a source IP address of 10.10.31.17 AND a destination IP address of 10.10.31.15 AND a protocol of tcp
OR
-
Events that have a source IP address of 172.10.31.17 AND a destination IP address of 172.10.31.15 AND a protocol of tcp
You cannot perform a search or save a search on a compound constraint. You also cannot retain compound constraints when you use the event view links or click (switch workflow) to switch to another workflow. If you bookmark an event view with compound constraints applied, the constraints are not saved with the bookmark.