Hi All,
I am on rsa sa version 10.6.2 and recently i have observed that I am unable to filter the null values in reporting part of RSA SA.
Currently i was creating a report under Concentrator where under one column i see the column are appearing as blank.
So using null operation i tried to filter out the values where fields are appearing BLANK on execution but each time fail to filter out the null.
Need help on the same.
Concentrator rule sample used as follows:
------
device.type = 'ABC' && device.ip = 10.20.30.40 && action != 'Null'
------
Everytime it runs successful but still i see the null values are appearing in reports
Use - device.ip = x.x.x.x && action exists