Difference Between in" and "eq" While Filtering for Column user.src in Traffic Logs"

Overview

This document explains the difference between the keywords "in" and "eq" when used for user column.

When filtering the traffic logs based on source user column under Monitor > Logs > Traffic if using the "eq" keyword it will look for an exact match as shown below:

In the example above, user.src eq 'plano2003\csharma' was searched, which gives the results sourced only from this user.

However, the "in" keyword can be used to search for all the users that are part of a group, shown as follows:

In the example above, all the traffic was searched that is sourced from users that are part of user.src in 'cn=sslvpn,cn=users,dc=plano2003,dc=com.

owner: csharma