Controling a report

[RSAAdmin]

Hi,

i'm having hard time with this one:

i would like to create a report that shows only the records with value of 3 or moreat the count column.

for example:

think of a summry report like this -

SrcIP           Count

1.1.1.1         5

1.2.3.4         2

2.2.2.2         4

i want the report to show only addresses: 1.1.1.1 and 2.2.2.2

any idea about that?

[RSAAdmin]

You can do this in the SQL where clause...

something like:

........ AND (count >= 3)

Obviously count needs to be the field you've selected.

Hope this helps!

Adam

[RSAAdmin]

acctualy you can't because envision won't let you touch any count field giving you an error...

this is the first thing i've tried but thanks anyway.

[RSAAdmin]

Interesting...

I jsut looked a a report we have working and part of the where clause is:

(RecBytes >= 3)

So the operators do work. Are you saying it just doesn't work with count? I haven't actually tested that, just assumed it would also work.

[RSAAdmin]

Hi,

there is no problem of doing the compressions with regular fields, the problem is that envision won't let you refer to any count field or any other function if to precise..

you can check it out by yourself

[CharlesBeierle]

You are correct the fields you mention: SUM() COUNT() etc cannot be used (as far as I know) to do what you need. You have to do that in event explorer which isn't where you want to do 'reports' per se.