I am having the same issue with "$". Specifically, I'm trying to create a rule that shows all user accounts enabled but want to filter out workstations - which always end with "$". The example below, regardless of how I set the condition operator, returns both workstations and actual users.
On a related note, are there any other condition operators available besides "equal to" and "not equal to"? The documentation seems to suggest so, but when I create the search, I can only toggle between "equal to" and "not equal to". Thanks.
SolarWinds, can someone from LEM team comment? Thanks! Capt. Obvious
I too am running into this...cisco CDP messages - looking to trigger on %CDP.
when I do *%CDP*, it still triggers on message like: "access-request 171:256:60f189816d32:alwaeqctafbzewcaxornptstcq/5hg/uvrcdpg=="
With text fields/values, there is only equals/not equals. If you happen to pick a numeric field/value, you will see things like greater than/less than - but there's only a few numeric fields, so you'll mostly see equals/not equals. Oh, with groups, you might see contains/not contains (sort of an "in the list" "is not in the list" type operator).
The other weird thing of note here is that filter logic/rule logic and search logic are slightly different, so in filters/rules you can look for literal characters differently than searches. You might be able to do literally what you want in a filter/rule but not in a search. The text based searches also might operate differently than the field = value searches.
Hopefully someone on the team can jump in on a search-based workaround. We used to be able to use quotes around a search to force it to match exactly, but that behavior changed a while back, too.
Thanks for input!
What I have done with the "$" is put the splat on both sides *$* and it seems to capture just the devices with that on the end. I am not sure if that is what you are looking for, otherwise if your "$" is in the middle somewhere, the try this syntax and it might work "*Sis*$*or*.
Just try and mix it up.
Hope this helps.