Submit a ticketCall us

Have You Auto Renewed? If not, you're missing out.
The SolarWinds Renewal Program comes with a host of benefits including the most recent product updates, 24/7 technical support, virtual instructor-led training and more. Experience all of this with the convenience of Auto Renewal, and never worry about missing any of these great benefits. Learn More.

Home > Success Center > Log & Event Manager (LEM) > LEM Administrator's Guide > Manage LEM filters: Add, edit, view, and more

Manage LEM filters: Add, edit, view, and more

Updated: September 15, 2017

This topic describes how to work with filters in the LEM console. See About LEM filters and filter categories for general information about filter categories.

See Get started building custom filter expressions in LEM to learn how to write filter expressions.

Open filters in the LEM console

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Monitor.

    The LEM console switches to Monitor view. The Filters pane in the top left corner lists filters and filter categories.

  3. Click a filter category to expand it and view its filters.

  4. Click a filter to view its events in the event grid.

Manage filter-based widgets in Monitor view

See Monitor view in the LEM console.

Create a new filter

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Monitor.

  3. In the Filters pane, click to select a filter category for the new filter. This tells LEM which category to add the filter to.

  4. Click in the Filters toolbar and select New Filter.

    The Filter Creation window opens.

    File:Success_Center/Reusable_content_-_InfoDev/LEM/Log_and_Event_Manager_Administrator's_Guide/LEM_Administrator's_Guide/0660-Manage_LEM_filters_Add_edit_view_and_more/filter-creation-groups-pane2.png

  5. Complete the form.

    See Get started building custom filter expressions in LEM to learn how to write filter expressions.

    • See the following table for help completing the Filter Creation page.
    • Use the Filter Status section to verify, troubleshoot, and resolve any problems with the filter logic.
  6. Click Save.

    The new filter displays in the selected filter group.

The Filter Creation form fields
Column Description
Name Enter a filter name. This name will identify the filter in the Filters pane.
Lines Displayed Select the total number of events to display for this filter. You can select up to 2,000 lines. The default value is 1,000 lines.
Description Enter a short description of the filter.
Conditions (box) Drag one or more event(s) and/or LEM group(s) into the Conditions box. See Create conditions to filter event reporting for more information.
Notifications (box) To have LEM display a notification when a filter captures an event, drag the notification from the Notifications group into the Notifications box and configure the notification method. Notifications include displaying a pop-up message, displaying new events as unread, playing a sound, or using blinking text to display the filter name.

Edit an existing filter

You can edit an existing filter using the Filter Creation window. After you open the filter, you can change the name, description, configuration, and notification settings.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Monitor.

  3. In the Filters pane, expand the filter group that contains the filter that you want to edit.

  4. Select the filter to edit, then click on the Filters toolbar and select Edit.

    The selected filter opens in the Filter Creation window.

  5. Edit the Filter Creation form as needed.

    Use the Filter Status section to verify, troubleshoot, and resolve any problems with the filter logic.

  6. Click Save to save your changes.

Share a filter with another user

See Export a filter or filter category for steps.

You need the Administrator or Auditor role to share a filter with another user. To share a filter with Monitor-role users, see Specify the filters that users assigned the Monitor role can use in the LEM console.

Clone a filter

When you clone a filter, you copy an existing filter and label it with a new name. Cloning allows you to quickly create filter variations.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Monitor.

  3. In the Filters pane, select the filter that you want to clone.

  4. Click on the Filters toolbar and select Clone.

    LEM creates a cloned copy of the filter below the original filter and appends Clone to the name.

  5. To edit the filter and rename it, select the filter, click , and select Edit.

  6. Edit the Filter Creation form and click Save.

    The cloned filter is saved to your Filters list.

Copy a filter

Copy a filter if you want the filter to appear in more than one filter category.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Monitor.

  3. In the Filters pane, open the filter group that contains the filter that you want to copy.

  4. In the Filters pane, select the filter category that you want to copy the filter to.

  5. Select the filter that you are copying, then press Ctrl and drag the filter to the targeted group.

    A copy of the filter appears in the new filter group.

Create a backup copy of a filter for archival purposes

See Export a filter or filter category for steps.

Export a filter

See Export a filter or filter category for steps.

Export a filter when you need to:

  • Move a filter to another workstation so that another LEM console user can use the same filter
  • Export a filter to a folder for backup or archival purposes
  • Send SolarWinds Technical Support a copy of a filter for troubleshooting purposes

Import a filter

See Import a filter or filter category for steps.

Use the Import a filter command to import a .swfil file into LEM.

Delete a filter

Deleting a filter will also delete any widgets associated with the filter. Deleted filters and widgets cannot be restored.

  1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

  2. Click Monitor.

  3. In the Filters pane, select the filter that you want to delete.

  4. Click next to the filter.

  5. Click Yes to confirm the delete.

    The filter disappears from the Filters pane.

Send a filter to nDepth

To view historical filter data about a filter while in Monitor mode, select the filter, click in the Filters pane, and select Send to nDepth. The console will open the filter in the nDepth search engine under Explore mode. See Choose a filter in Monitor view to send to nDepth for historical search for steps.

Last modified

Tags

Classifications

Public