Where can i find a reference for gui log search syntax?

[choff123]

Im having trouble finding a reference for gui log search syntax. I know i can run a custom report but that not too intuative and id rather just have a reference of all the options available.

for example, can I use IP ranges?

eg: 192.168.1.0/24-192.168.55.0/24 ?

thanks

[gwesson · Accepted solution]

While there is an administrator guide, many customers like to use the query builder option on the logs. If you go to Monitor > Logs > Traffic, near the top query bar there is a + icon. Click that to open the query builder. From there you can see all the options for developing a custom query. Once you build the query, it can be saved for later use.

You can also click any of the values in any displayed column to add that item as a filtered item.

To answer your specific question, you cannot use ranges. You can use a more specific subnet. For your example, you may be able to use 192.168.1.0/18 which will get everything from 192.168.0.0 to 192.168.63.255.

Hope this helps,

Greg

[choff123]

ok, thanks,

yeah im trying to see whats going on with ssl outbound traffic in the middle of the night, and i want to exclude tons of ranges in my search (google, live.com). sites like akamai have lots of ranges that dont fit nicely into a 'normal' B or C class.

Ill look into the query builder, thanks!