Filter expression examples

collector_feed_names contains "abc"

conditions = 1
condition_count = 12
condition_nw_count > 0
condition_client_count < 10
condition_server_count != 10
condition_app_count >= 10
condition_content_count = null
condition_custom_count between 5 10

Number of informational conditions for this session, page, or object for the specific category:

• Total
• Network
• Client
• Server
• Application
• Content
• Custom

Cookies sent from the client to the server

Basic authentication (credentials)
The authentication string sent in the request. This is a standard method of passing authentication credentials defined by the HTTP RFCs and supported by most browsers.

Number of error conditions for this session, page, or object for the specific category:

• Total
• Network
• Client
• Server
• Application
• Content
• Custom

First public IP found in x-forwarded-for (or client IP)
The public IP address closest to the browser and the one used to look up geographic information

first_public_geo.city contains "mtl"
first_public_geo.country is "ca"
first_public_geo.dns_name is null
first_public_geo.isp contains "abc" ignorecase
first_public_geo.latitude = 1200
first_public_geo.longitude = 1200
first_public_geo.metro_area contains "abc" ignorecase
first_public_geo.organization contains "abc"
first_public_geo.region is "001"

Geolocation criteria:

• City
• Country code
• Domain name
• Internet service provider (ISP) name
• Latitude
• Longitude
• Metropolitan area
• Organization name
• Region code

A group token extracted from traffic
Can be used to associate a session with a specific group of users

Number of informational conditions for this session, page, or object for the specific category:

• Total
• Network
• Client
• Server
• Application
• Content
• Custom

Indicates whether this object represents a page component (for example, an image, a stylesheet, or a script file)

Indicates whether this item was involved in the creation of a promoted document

During Object-type detection, when a hit (HTTP request and response pair) is classified as a Component and no associated parent Container is detected, it is determined to be orphaned. This parameter can be used to identify a page component orphan that results from misconfiguration or traffic patterns. For example, if a user clicks a thumbnail link on a web page to view the full image, it is classified as a Component. However, if the full image is displayed long after a page timeout, it is promoted and classified as a Document because the user clicked and received a new page without children components.

time_host > 200
time_network > 200
time_primary_redirect < 100
time_redirect < 12
time_ssl > 300
time_e2e = 500

Latency time, ms:

• Host latency — Time spent on the servers to process the request
• Network latency — Time spent transferring data back and forth over the network when transmitting the request and the response
• Primary redirects latency — Time spent on primary redirects
• Redirects latency — Time spent on redirecting the client to get to this object or page
• SSL latency — Latency introduced from negotiation of SSL connections
• Total latency — End-to-end latency of the entire object, including HTTP redirects

The MIME type of content contained in the response
This directly controls how clients interpret the content.

Time the browser took to request more objects during the loading of a page, ms

post_param("parameter") between "foo" "bar"

POST parameter passed from the client to the server

Redirect URL:

• URL redirect path element — A list of elements that make up the path on the first redirect to this page
• URL redirect path parameter — A list of key-value pairs found within the path on the first redirect to this page
• URL redirect query string — Query portion of the first redirect to this page
• URL redirect query parameter — A list of the key-value pairs found within the query string on the first redirect to this page
• URL redirect stem — Full path of the first redirect to this page up to (but not including) the query string
• URL redirect — Complete URI of the “initial redirect that leads to the page,” including protocol, server host, port, path + parameters, and query parameters. If there is no redirect leading to that page, this field is null.
• URL redirect extension — File extension contained within the URI Redirect field
• URL host — Domain of the first redirect to this page
• URL redirect port — Target server port for the first redirect to this page
• URL redirect protocol — Protocol of the first redirect to this page

Referrer URL:

• Path element — A list of elements that make up the path on the previous request
• Path parameter — A list of key-value pairs found within the path on the previous request
• Query string — The query portion of the previous request
• Query parameter — A list of the key-value pairs found within the query string on the previous request
• Stem — The full path of the previous request up to (but not including) the query string
• Referrer — URL of the site or page, or both, that referred the client to this site
• File extension — File extension of the previous request
• Host — ID of the server that handled the previous request
• Port — Target server port for the previous request
• Protocol — Protocol of the previous request

server_id contains "abc"
server_ip match 2.2.2.2 mask 255.255.255.192
server_port = 80

Server parameters:

• Server ID — Name or identifier of the server or network infrastructure component that serviced this request
• Server IP — IP address of the server that responded to the request
• Server port — TCP port of the server that responded to the request

Server cookie parameter

The cookie header passed from the client to the server

TCP-related filters:

• TCP out-of-order — Number of out-of-order TCP segments in the transmission. This usually indicates route flapping or poor link load balancing.
• TCP packets count — Number of TCP packets for this object, error, page, or session
• TCP retransmits — Number of TCP segments retransmitted. A high number of retransmissions may indicate traffic shaping or packet loss.
• TCP round-trip time, ms — Total TCP round-trip time of all objects or pages between the client and the server
• TCP round-trip time tap-to-server, ms
• TCP round-trip time tap-to-client, ms

Effective throughput in bits per second. May be blank if the request was too small to accurately measure throughput

URL-related filters:

• URL path element — A list of the key-value pairs found within the path of the main URL
• URL path parameter — A list of the main elements that make up the path on the main URL
• URL query string — The query portion of the request URL
• URL query parameter — A list of the key-value pairs found within the query string on the main URL
• URL stem — The full path of the request up to (but not including) the query string
• URL — The full URL of the item

• URL file extension — The file extension contained within the URL for this request

• URL host — Host that handled the request

• URL port — URL's port
• URL protocol — The protocol used by this request

The user-agent string contained in the header of the request. This string contains information concerning the user's environment, for example, browser type, OS, and so on.

The name of the application invoked by the client

The header, inserted by application-monitoring solutions to enable drill-downs extracted from the HTTP response