To search for events based on where they originated (4380325)

To search for events based on where they originated

NOTE: By default, all events regardless of the workstation or server from which it originated are included in the search. 

1. Open the Origin tab. 
2. Click Add. 
3. Enter the wildcard expression to use to search for a workstation or server, based on its NetBIOS name or IP address:
   1. Select the comparison operator to use: Like or Not Like.
   2. In the field to the right, enter the pattern (character string and * wildcard character) to be used to search for a match. Use the * wildcard character to match any string of zero or more characters.  
4. After entering the wildcard expression to use, click OK to close the dialog and add the wildcard expression to the ‘origin’ list.
5. When this search is run, Change Auditor searches for change events originating on workstations and servers whose name or IP address matches the specified wildcard expression. 

NOTE: You can use Add with Events (instead of Add) to select a workstation or server that already has an event associated with it in the database. The workstations and servers available for selection are based on the ‘when’ clause (When tab) and the search limit (Info tab) specified for the current search.