AnsweredAssumed Answered

How many characters does Netwitness query filtering able to afford? 

Question asked by Xue YQ on Jan 20, 2020
Latest reply on Jan 20, 2020 by John Snider

My rules is to check for hits from the list, which the list might contains quite a huge data. 

For example the rule is: ip.dst = $[list]

List: 1.1.1.1, 2.2.2.2,......, etc.

When I drill in to particular hits, the query should be: (ip.dst = 1.1.1.1, 2.2.2.2, ....... +2000 character).

But it end up to be: (ip.dst = 1.1.1.1, 2.2.2.2, ......., 56.56.56.56

It stops half way. And having issues of syntax error, which in this case is due to the "(".

Outcomes