topic Re: Panorama Query Builder in General Topics

Panorama Query Builder

Laurent_Dormond — Mon, 06 Aug 2018 13:42:03 GMT

Hello,

We are an organization with thousends of users. Our user names have prefixes stranding for their departement or unit, for example tic_username for IT, mkt_username for marketing and so on.

I would like to generate custom report using Panorama Query builder but I'm unable to achieve this.

I have tried to use source user filters ("source user in" and "source user equal"). I have tried with our without domain name, with or without wildcard, but it always return no result.

How to properly use the query builder ?

Regards,

Laurent

Re: Panorama Query Builder

reaper — Mon, 06 Aug 2018 14:32:38 GMT

Hi Laurent

have you tried (user.src in 'tic_'), for example, no wildcards

It would be helpful if you included how you formatted your queries exactly

Searching through logs, where do I start?

Re: Panorama Query Builder

Laurent_Dormond — Mon, 06 Aug 2018 15:04:17 GMT

Hi reaper,

Yes I have tried this without success.

I have already tried following queries :

(user.src in 'prefix_')

(user.src in 'domain\prefix_')

(user.src in 'prefix_*')

(user.src in 'domain\prefix_*')

(srcuser eq prefix_)

(srcuser eq domain\prefix_)

(srcuser eq prefix_*)

(srcuser eq domain\prefix_*)