FortiAnalyzer
FortiAnalyzer can receive logs and Windows host events directly from endpoints connected to EMS, and you can use FortiAnalyzer to analyze the logs and run reports.
iyotov
Staff
Staff
Article Id 196715

Description
Using a NOT operator (!=) in the log search is excluding the NULL values from the result.

For example, the column 'Action' contains values 'perf-stats', 'change', 'disconnect' and 'NULL'.

action!="perf-stats" returns only records containing 'change' and 'disconnect'. 'NULL' is excluded.



Solution
To display the NULL value, the filter must explicitly include the following:

action!="perf-stats" OR  action=""


 

 

Contributors