This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Need to filter on an empty field

I am trying to set up a filter to differentiate between User Logons coming from an actual user and those coming from a machine or an application. For example, I don't want to see logon events coming from a SolarWinds Orion polling engine, but I do want to see logins from any actual physical user.

It looks like the SourceMachine field populates with only a "-" when a User logs in, but I cannot figure out how to configure the filter for "SourceMachine is empty" or the equivalent.

Can anyone help me do this? Thanks so much.