I am trying to set up a filter to differentiate between User Logons coming from an actual user and those coming from a machine or an application. For example, I don't want to see logon events coming from a SolarWinds Orion polling engine, but I do want to see logins from any actual physical user.
It looks like the SourceMachine field populates with only a "-" when a User logs in, but I cannot figure out how to configure the filter for "SourceMachine is empty" or the equivalent.
Can anyone help me do this? Thanks so much.
