Cisco Cisco Web Security Appliance S690 User Guide
W O R K I N G W I T H R E P O R T F I L T E R S
C H A P T E R 4 : R E A D I N G A C C E S S L O G S W I T H S A W M I L L F O R I R O N P O R T
43
WO R K I N G W I T H R E P O R T F I L T E R S
There are many filters available to you when viewing reports. The report filters that are
applied to the report determine what statistics you see. The filters let you “zoom in” on one
part of your data. You can use the filters to get information about a particular day, a particular
directory, a particular domain, or more.
applied to the report determine what statistics you see. The filters let you “zoom in” on one
part of your data. You can use the filters to get information about a particular day, a particular
directory, a particular domain, or more.
• Global Filters. These remain in effect until they are removed in the Global Filters page.
• Date/Time Filters. These remain in effect until they are removed in the Calendar page. See
• Zoom Filters. These remain in effect until they are removed in the Calendar page. See
All of these filters are combined when used together; i.e., an item is included if it is selected
by the Global Filters AND by the Date/Time Filters AND by the Zoom Filters. For instance, if
the Global Filters show events during 1am-2am, and the Zoom Filters show events on January
1, then the table will show events from January 1, during 1am-2am.
by the Global Filters AND by the Date/Time Filters AND by the Zoom Filters. For instance, if
the Global Filters show events during 1am-2am, and the Zoom Filters show events on January
1, then the table will show events from January 1, during 1am-2am.
If there are no filters in place, that means you are looking at your complete data; all available
data is represented by the graphs and tables shown. If the The Report Bar shows that there are
filters active, then you are not seeing your entire data; you are seeing only a portion of it. The
portion you are looking at depends on the filters. For example, if the only filter is a /dir1/ filter
on the page field, then the data displayed shows only those hits which were on /dir1/ or pages
contained in /dir1/ (or in other directories contained in /dir1/, or pages in them, etc.). If you
have 1000 hits on your site, and 500 of them were inside /dir1/, then if there are no filters
active, you will see 1000 hits in the tables and graphs, or all the hits on your site. But if there
is a Filter /dir1/ on the page field, you will see 500 hits, or only those hits in /dir1/.
data is represented by the graphs and tables shown. If the The Report Bar shows that there are
filters active, then you are not seeing your entire data; you are seeing only a portion of it. The
portion you are looking at depends on the filters. For example, if the only filter is a /dir1/ filter
on the page field, then the data displayed shows only those hits which were on /dir1/ or pages
contained in /dir1/ (or in other directories contained in /dir1/, or pages in them, etc.). If you
have 1000 hits on your site, and 500 of them were inside /dir1/, then if there are no filters
active, you will see 1000 hits in the tables and graphs, or all the hits on your site. But if there
is a Filter /dir1/ on the page field, you will see 500 hits, or only those hits in /dir1/.
The filters are an extremely powerful way of getting detailed information about your site. If
you want to know what day you got the most hits on /dir1/, you can do that by adding /dir1/ as
a filter, and then changing to the “Years/months/days” view. With /dir1/ as a filter, you will see
only those hits on /dir1/ (500 of them, in the example above), and you will see how those 500
hits break down by date and time. You can add an additional filter to the date/time field if you
want to examine just the hits on /dir1/ on a particular day. This gives you almost infinite
flexibility in how you want to examine your data.
you want to know what day you got the most hits on /dir1/, you can do that by adding /dir1/ as
a filter, and then changing to the “Years/months/days” view. With /dir1/ as a filter, you will see
only those hits on /dir1/ (500 of them, in the example above), and you will see how those 500
hits break down by date and time. You can add an additional filter to the date/time field if you
want to examine just the hits on /dir1/ on a particular day. This gives you almost infinite
flexibility in how you want to examine your data.
Another way to change filters is to click on something in the statistics. For instance, clicking
on a directory name in a page table will “zoom in” on that directory by adding it as the page
field filter. Clicking on a month in the calendar view will “zoom in” on the month by adding it
as the date/time field filter. If the “filter checkboxes and menu” option is turned on (using the
Show menu; see below), you can click the check box next to any item and choose a view
from the menu below the table, to set that item as a filter, and then change the view to the
view you select. To answer the question, “What days did I get hits on this directory?” you can
click the checkbox next to a particular directory name, and select “Show checked data in ‘Top
days’ view”, this will add the directory as a page filter, and also change to the top days
statistics view.
on a directory name in a page table will “zoom in” on that directory by adding it as the page
field filter. Clicking on a month in the calendar view will “zoom in” on the month by adding it
as the date/time field filter. If the “filter checkboxes and menu” option is turned on (using the
Show menu; see below), you can click the check box next to any item and choose a view
from the menu below the table, to set that item as a filter, and then change the view to the
view you select. To answer the question, “What days did I get hits on this directory?” you can
click the checkbox next to a particular directory name, and select “Show checked data in ‘Top
days’ view”, this will add the directory as a page filter, and also change to the top days
statistics view.
WSA_Sawmill.book Page 43 Monday, March 15, 2010 10:31 AM