The Quick-Filter

The Trace Analyzer features a useful function known as the Quick-Filter, which enables the fast creation of ad-hoc data filters for searching and filtering operations. The Quick-Filter is a special, temporary data filter which can be created, edited, and put into use quickly, without the need to manipulate the full filter customization interface in the Configuration Dialog Window. This section describes the Quick-Filter feature.

Purpose

When viewing a trace file, there is quite often a need to quickly generate a data filter "on-the-fly" for a singular purpose, such as a search for a specific datum, or to perfom an ad-hoc refinement of the data set. Typically, there is no need to name or to save this filter, since it is only needed temporarily, perhaps even for a single operation.

The Quick-Filter feature was designed to address this need, by providing a mechanism to quickly generate a filter expression which is assigned to a unique, anonymous, transient, data filter. Once generated, the Quick-Filter appears in the Select Filter list of available filters for searching and filtering operations. It can be used like any permanent filter during the current Trace Analyzer session; however, it is not retained when the program ends unless it explicitly is named and saved by the user.

Although only one filter expression can be assigned to the Quick-Filter at a time, all previous expressions which have been used within the current Trace Analyzer session are retained. Thus, a Quick-Filter expression generated earlier in the session can easily be recalled and used again.

If a Quick-Filter expression is deemed useful for longer term purposes, it may optionally be named and saved permanently.

Creating the Quick-Filter

The Quick-Filter is generated in one of two ways:

via auto-generation, by double clicking on a data cell in the current Overview Report; or
via manual generation, by entering an expression in the Define Quick-Filter dialog window.

Auto-Generation

Most cells displayed in the current Overview Report can be double-clicked to automatically generate a Quick-Filter expression. Double clicking on cells in the Mark column will not produce an expression.

When a double click on a valid cell is detected, the program determines what data currently is being presented in the cell, and what protocol field currently is being represented by that cell. Unless the cell is in a Summary Interpretation column, these two pieces of information are used to form a binary, logical, equality expression of the form

<PROTOCOL_FIELD_ID> = <DATA_VALUE>

So, for example, if the data cell contained the data value 209.149.180.210, and that data cell represented a destination IP address, the Quick-Filter expression formed would be

IP:DA = 209.149.180.210

The IP:DA element is the protocol field ID of the Destination Address protocol field within the IP protocol definition. If the data cell contained the symbolic name alias www.goldencode.com, the resulting expression would be

IP:DA = www.goldencode.com

The resulting expression immediately is presented in the Define Quick-Filter dialog window, from which the filter may be edited, named, saved, or applied.

Empty Cells. If an empty table cell is double-clicked, a different type of expression is generated. In this case, the expression will test for the lack of data: The column in which the double-click occurred is analyzed to determine which protocol fields are referenced by that column. Each of these protocol fields are applied to the @isnull user function to create an expression which tests that each of these protocol fields is not present in a data record. For instance, suppose a column has two data sources: HTTP Command String (HTTP:CMD.STR) and HTTP Server Response (HTTP:RESP.RSP). Double-clicking on an empty cell in this report column would produce the following expression:

@isnull(HTTP:CMD.STR) and @isnull(HTTP:RESP.RSP)

This expression will resolve to true for every record which has neither an HTTP Command String nor an HTTP Server Response field. Note that simply enclosing this expression in parentheses and negating it using the negation operator (!) as follows

!(@isnull(HTTP:CMD.STR) and @isnull(HTTP:RESP.RSP))

produces an expression which tests for only those records which contain either an HTTP Command String or an HTTP Server Response, effectively filtering out all records which would otherwise produce an empty cell in this column of the report.

Summary Interpretation Column. This column, which is a special purpose column included in some reports templates (see Customizing Reports - Column Attribute Components for details), behaves slightly differently when double-clicked. Instead of producing a binary, logical, equality expression as described above, the Quick-Filter auto-generation mechanism produces an expression using the @protocol user function when this column is double-clicked.

The protocol ID argument which is inserted into the @protocol expression is the innermost protocol layer which is represented by the summary interpretation text displayed by the target Overview Report cell. For example, if the target cell in the Summary Interpretation column contained the following data

SMB C T=607A P=0054 U=3024 M=5133 Read From File 0D48

the double-click would yield the following Quick-Filter expression:

@protocol(SMBread)

This expression would filter out all data records except those that contain the SMB Read From File protocol.

Note: double clicking on some Overview Report data cells will generate an error rather than a Quick-Filter expression. This limitation may be addressed in a future release of the Trace Analyzer.

Manual Generation

Quick-Filter expressions may be created manually by typing a valid expression into the Define Quick-Filter dialog window. This method assumes the user has a working knowledge of the data filter expression syntax. As such, only advanced users should attempt to manually generate a Quick-Filter expression. Users less familiar with data filter expression syntax are encouraged to utilize the Auto-Generation capability of the Quick-Filter where possible, or to use the Filter Configuration interface, which enables interactive filter expression building.

Define Quick-Filter Dialog Window

The Define Quick-Filter dialog window is the interface which presents the current Quick-Filter expression and allows it to be edited. This interface is depicted in Figure 1.

Figure 1. Define Quick-Filter dialog window

This dialog is invoked in one of two ways:

via the Configure - Quick-Filter action;
by double-clicking on an Overview Report table cell (see Creating the Quick-Filter - Auto-Generation).

The components of this dialog have the following meanings:

Quick-Filter Expression. This is an editable combo-box which presents the current Quick-Filter expression for editing, and which lists all Quick-Filter expressions which have been defined during the current Trace Analyzer session (the history list - see Figure 2). Selecting any entry in the history list sets the selected expression as the current Quick-Filter expression. Note that the history list is not persistent across Trace Analyzer sessions.
Save as permanent filter. This checkbox should be selected if the current filter expression should be saved as a permanent filter. Checking this box enables the Filter Information group box.
Apply filter immediately. This checkbox should be selected if the current filter should be applied immediately for the purpose of filtering the current data set. This will take place upon dismissing the dialog via the OK button.
Filter Information. This group box contains controls which are only used if the current Quick-Filter is to be saved as a permanent filter. It is enabled by selecting the Save as permanent filter checkbox.
Name. A unique name for the new filter should be entered in this text entry field.
Description. A brief description of the filter's purpose should be entered in this text entry field.

OK verifies the current Quick-Filter expression and closes the dialog. If the Apply filter immediately checkbox is selected, a filter job which uses the Quick-Filter is added to the job queue.
Cancel dismisses the dialog without verifying the filter expression.
Help displays this document in the help browser.

Figure 2. Quick-Filter history list