Query will not report all data.

Discussion created by rwengewicz on Oct 27, 2010
Latest reply on Dec 26, 2010 by RSA Admin

I am trying to pull data that is looking for servers from a watchlist and that the message ID is Insert or Update. I originally had this query

Agent IN (${sox}) AND MessageID IN ('Update','Insert')

this only provided Update information no Insert so I switch this to

Agent IN (${sox}) AND MessageID LIKE 'Update' OR MessageID LIKE 'Insert'


The second version pulls what is needed but I thought that the first one would have provided the information needed also. Why is there such a difference?