Panorama Query Builder

[Laurent_Dormond]

Hello,

We are an organization with thousends of users. Our user names have prefixes stranding for their departement or unit, for example tic_username for IT, mkt_username for marketing and so on.

I would like to generate custom report using Panorama Query builder but I'm unable to achieve this.

I have tried to use source user filters ("source user in" and "source user equal"). I have tried with our without domain name, with or without wildcard, but it always return no result.

How to properly use the query builder ?

Regards,

Laurent

[reaper]

Hi Laurent

have you tried (user.src in 'tic_'), for example, no wildcards

It would be helpful if you included how you formatted your queries exactly

Searching through logs, where do I start?

[Laurent_Dormond]

Hi reaper,

Yes I have tried this without success.

I have already tried following queries :

(user.src in 'prefix_')

(user.src in 'domain\prefix_')

(user.src in 'prefix_*')

(user.src in 'domain\prefix_*')

(srcuser eq prefix_)

(srcuser eq domain\prefix_)

(srcuser eq prefix_*)

(srcuser eq domain\prefix_*)