Using 2 filters "vmw_nsxt_firewall_src" and "vmw_nsxt_firewall_dst" together do not populate any events and shows 'No results'.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• A manual query with any 2 filters together with a substring "contains" yields "No results"
  For example in following screenshot 2 filters "vmw_nsxt_firewall_src" and "vmw_nsxt_firewall_dst" are used.
  
• Using one of the filter (vmw_nsxt_firewall_src or vmw_nsxt_firewall_dst) at a time, shows log events.

 

Environment

Aria Operations for Logs 8.18.x

Cause

This is an expected behavior as this is how 'Log Insight Pattern Insight Query Language (PIQL)' behaves when we use a contains on substring.

Resolution

As a workaround, adding a "*" asterisk to the end of the "search query" when using contains filtering in a substring.