Sorting and Filtering Events

You can sort and filter events that appear in the event console to customize your view.

You can sort events by any column that appears in the event console. To sort events, click a column header. Clicking the header toggles between ascending and descending sort order.

Filter options appear below each column header. A match value can be any full string or a subset of a string, optionally with the wildcard (*) contained in the values in that column. You can also use "||" (OR), or "!!" (NOT) expressions to further target your filters. For example, typing !!windows in the Event Class filter will return all the non-Windows device events.

Figure 13. Event Console Filter Options Event Console Filter Options

You can filter the events that appear in the list in several ways, depending on the field type:

  • Resource - Enter a match value to limit the list.
  • Component - Enter a match value to limit the list.
  • Event Class - Enter a match value to limit the list.
  • Summary - Enter a match value to limit the list.
  • First Seen - Enter a value or use a date selection tool to limit the list.
  • Last Seen - Enter a value or use a date selection tool to limit the list.
  • Count - Enter a value to filter the list, as follows:
    • N - Displays events with a count equal to N.
    • :N - Displays events with a count less than or equal to N.
    • M:N - Displays events with a count between M and N (inclusive).
    • M: - Displays events with a count greater than or equal to M.

To clear filters, select Configure > Clear filters.

You also can re-arrange the display order of columns in the event console. Click-and-drag column headers to change their display.