The LiveNX flow system view has a Search field to filter the system view based on the system and flow entities. The Search field is located under the Flow tab’s main toolbar and is available in the system topology, the flow dashboard and the flow reports.

Searchable system entities include device, interface, site, tag and WAN parameters. Searchable flow entities include the IP address, DSCP, port, protocol, and application. CIDR notation can be used on the IPaddress, for example, “flow.ip=10.0.0.0/8.” Wildcards can be used on the IP address, for example, “flow.ip=10.0.0.2/0.255.255.0” would match the IP address where the first and last octet are 10 and 2 respectively. More granular matches can be done such as “flow.ip=72.128.0.22/0.127.255.0.”

Click on the Search field to begin typing in the desired search parameters.

The general syntax of the search field is shown as shaded text to represent an example entry.

(site = Honolulu | site = Chicago) & wan & flow.app = WebEx-meeting

Use the Enter key to apply the search. Click on the ‘X’ to clear the search field. Click on the down carat symbol to display a history of previous searches. The searches are kept on a per client basis; the history is removed with the LiveNX Client is closed.

Boolean expressions OR = ‘|’ and AND = ‘&’; grouping uses ‘( )’.

The Search editor provides tooltips to assist in creating the search expressions. Click on the desired entity to add it to the expression. NBAR uses dynamic lists based on the capability of the device.

Filtering can be done through the main toolbar dropdowns as well as the Flow Display Filter combo box. Filtering is first done via the main toolbar dropdowns, the Flow Display Filter combo-box and lastly, the Search field.

The Search is done with a one pass search. In addition, the system level entities need to be in a single clause. For example, (site = Honolulu | site = Chicago) & flow.ip=1.1.1.1 is allowed, but (site = Honolulu & flow.ip=1.1.1.1) | (site = Chicago & flow.ip=1.1.1.1) is not allowed.

LiveNX supports a large number of system and flow searchable entities. Click on the ? to display the list of searchable entries as well as some example search expressions.

Relational operators > and < can be used for flow.medianet.packetLossCount and flow.medianet.packetLossPercent, and only in topology view. For example, show flows with packet loss > 3% in topology view.