int13h/squert

filters with status field

Closed this issue · 1 comments

I guess this is just a documentation error.

On the filters help, status is indicated as one of the available fields to be used.

Using "status" as a field (ex: "filter": "(event.status = $)" ) doesn't work.
There's probably another table with a status field in the query result.

event.status must be used as a field.

I meant:
"filter": "(status = $)" doesn't work.

The syntax that works is:
"filter": "(event.status = $)"