cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1055
Views
0
Helpful
1
Replies

Filtering Multiple Auth Users in SawMill

Scott H
Level 1
Level 1

I am unable to generate a report with more than a single person. The only attributes I am applying is:

Statistics for 01/Jun/2010 - 30/Jun/2010, 30 days 
Report is filtered and shows data for
  Action is NOT: TCP_DENIED
  Auth User is: local\lcl4034@ntlm, local\scott@ntlm (<<These are applied as "Wildcard Expression")

With a single user, I can generate a report without issue but the second I add another user the report is blank. At this point it is all or just 1. I know I have sucessfully done this in the past but now it is not working.

1 Reply 1

allscott
Level 1
Level 1

Easiest way is to add more indivudal items per field type query rather than trying to build a more complex argument within a single element.

For example:

Hope this helps