Let's stay on the same example, but change it a bit.

Suppose instead you want the Uplink and Downlink entries - nothing else. One filter for Uplink and one filter for Downlink could easily be created, but not used simultanely (no entries would probably appear, since they would have to have both keywords in the same entry).

Using the structure from the last example, we would have to make some minor changes, using three steps. This is the original query:

HEADER_HOST in ('Switch1', 'Switch2') and MSG_CONTENT NOT LIKE '%Uplink%' and MSG_CONTENT NOT LIKE '%Downlink%'

First remove the 'NOT' SQL keywords, since we now want these entries, rather than filtering them out:

HEADER_HOST in ('Switch1', 'Switch2') and MSG_CONTENT NOT LIKE '%Uplink%' and MSG_CONTENT NOT LIKE '%Downlink%'

Secondly, change so that either of the words would be enough to pass the filter:

HEADER_HOST in ('Switch1', 'Switch2') and MSG_CONTENT LIKE '%Uplink%'
and or MSG_CONTENT LIKE '%Downlink%'

So far we now have:

HEADER_HOST in ('Switch1', 'Switch2') and MSG_CONTENT LIKE '%Uplink%' or MSG_CONTENT LIKE '%Downlink%'

This filter, although valid SQL syntax, would actually not accomplish what we want. It would choose:

• Entries with text Uplink from Switch1 or Switch2

* OR *

• Entries with text Downlink (from any host)

The reason being that the keyword AND binds harder than keyword OR. We need to fix this with parenthesis:

HEADER_HOST in ('Switch1', 'Switch2') and ( MSG_CONTENT LIKE '%Uplink%' or MSG_CONTENT LIKE '%Downlink%' )

This would accomplish exactly what we want; Entries from Switch1 or Switch2 containing either Uplink or Downlink.