Filters in BMC Real End User Experience Monitoring Software Edition can process various types of data. The following sections describe how the system handles certain values in a filter expression:
You can also use a the null modifier in a filter.
If the data represented by an identifier cannot be accessed for some reason, the identifier returns null. A null value can be compared with only another null value. If you try any other type of comparison with null, the expression evaluates to false.
The system compares IP addresses as if they were integers. You can use standard operators, or you can create more precise queries by using the match keyword and the mask modifier.
Examples of IP address evaluation using standard operators
client_ip is 172.21.2.8
client_ip is fe80:0:0:0:0:0:ac15:208
client_ip = 172.21.2.8
client_ip = fe80:0:0:0:0:0:ac15:208
client_ip = 172.21.2.8
client_ip = fe80::ac15:208
client_ip != 172.21.2.8
client_ip != fe80::ac15:208
client_ip > 172.21.2.8
client_ip > fe80:0:0:0:0:0:ac15:208
client_ip < 172.21.2.8
client_ip < fe80::ac15:208
client_ip between 172.20.6.88 172.21.175.2
client_ip between fe80::ac14:658 fe80::ac15:af02
client_ip in (172.20.6.88,172.21.175.2)
client_ip in (fe80::ac14:658,fe80::ac15:af02)
The match keyword is an IP-specific operator that enables you to compare an IP address against an IP address range or block. You can specify an IP range or block in the following ways:
(IPv4 only)Wildcards — You can substitute an asterisk, *, for one or more octets in an IPv4 address.
CIDR notation — You can use CIDR notation to specify an IP range. CIDR notation cannot be combined with wildcards or subnet masks.
client_ip match 172.21.2.8/13
client_ip match fe80::ac15:208/32
Masks — You can use the mask modifier to define subnet masks. Masks cannot be combined with wildcards or CIDR notation.
client_ip match 192.168.0.4/255.255.0.255
client_ip match fe80::ac15:208 mask ffff::fff8:0
The system differentiates strings from other value types through the use of double quotation marks. Any value enclosed in double quotation marks is treated as a string literal. If double quotation marks are not present, the value is assumed to match its context — that is, if the value is involved in a comparison with a known IP address, the value is assumed to be an IP address.
The following character literals can be used in strings:
Octal characters are represented by a backward slash followed by a three-character octal code, as follows: \nnn.
Hexadecimal characters are represented by a backward slash followed by x and a four-character hexadecimal code, as follows: