The first thing you need to do is move your expression within the double-quotes. Example: "src=10.1.1."
The second thing you need to do is escape the periods. Example: "src=10\.1\.1\."
To look for 10.1.1.0 to 10.1.1.149, I believe the following should work:
Let me know if this works.
Chris Foley | Support Representative
SolarWinds | IT Management, Inspired By You
Support:866.530.8040 || Fax:512.857.0125
Thanks for your help.
Unfortunately that didn't work, so I tried to simplify things by using a single placeholder, i.e.
"src=10.1.1."[0-9] and some variations.
The TEST button would occassionally, but the filter was never as I needed.
I then noticed I had the rule TYPE set to COMPLEX vs RegExp.
It started working better after this! Doh!
But the filter was still allowing 10.1.1.1, 10.1.1.2, etc - but also 10.1.1.1x and 10.1.1.xx, etc.
I finally restricted the IP address to single or double digits by including the next character in the string (a parenthesis), and repeated the OR variations as follows:
For IP Range 10.1.1.1 - 10.1.1.49 = "src=10.1.1.[1-9](" "src=10.1.1.[1-4][[0-9]("
For IP Range 10.1.1.50 - 10.1.1.25x = "src=10.1.1.[5-9][[0-9](" "src=10.1.1.[1-2][0-5][0-9]("
May not be the most efficient way - but it's working.