Weird Filter Logic

So I’m trying to set up a filter like the above. My understanding that the boolean of this should be like Citrix AND (Blue Cherry OR VDA). In the report there are Blue Cherry results by themselves (good) but not Citrix results by themselves (bad). (VDA doesn’t occur by itself and is always with Citrix.) Why are Citrix-only results being excluded when they shouldn’t be sufficient in the filter?

Thank you in advance.

You’re using the “does not contain” operator when you should be using “contains”.

You’re seeing “Blue Cherry” because those match the clause 'OR does not contain “VDA” ', while the Citrix and VDA are both getting excluded by 'AND does not contain “Citrix” ’

1 Like

wow I need to get more sleep, thank you

1 Like


So I thought I figured it out but apparently not. Still sleep deprived so I’m probably being dumb.

I need every result except those in OUs that have Citrix and Blue Cherry or VDA. So I would think the above would be NOT (Blue Cherry AND Citrix) OR NOT (Citrix AND VDA)

Yet some (not all!) of my Blue Cherry-only results disappeared, and still none of the Citrix-only results are showing. I’m so confused and my Red Bull is failing me.

You may have to describe what your OU structure looks like, I’m not sure I’m following.

I think you’re trying to express “does not contain Citrix and does not contain VDA” AND “does not contain Citrix and does not contain Blue Cherry” ?

1 Like

Yes, I want all results except when those two sets of two properties are both present. I need Blue Cherry results when they don’t contain Citrix and Citrix results when they don’t contain VDA.

So…
Contains Citrix and does not contain VDA and does not contain Blue Cherry?

No, I need Citrix when it’s by itself. And indeed I need all results whether they have Citrix or Blue Cherry or not, except when they’re in combination.

So where does VDA fit into the requirements?

VDA needs to be always excluded so I guess I don’t need to worry about a combination there

Is this a structure where VDA and Blue Cherry are subcontainers of Citrix? Can you sketch out your OU structure, I’m still not getting it…

Is it something like

  • OU=UnrelatedThing1, OU=Computers
  • OU=StuffToInclude, OU=Citrix
  • OU=VDA, OU=Citrix
  • OU=Blue\ Cherry, OU=Citrix
  • OU=UnrelatedThing2, OU=Users

  • ???

I’m still not sure I’m understanding what you want to include or exclude, but I think you may need to just specify longer matches for the “Active Directory Path” filter. You’re not limited to just looking at “one OU at a time”, i.e. instead of “does not contain Blue Cherry” you could use “does not contain OU=Blue\ Cherry, OU=Citrix”

So I fixed it, removed Citrix from the second pair in my last screenshot and everything’s working now. I just don’t understand why that made a bunch of Blue Cherry and Citrix only servers pop up when they shouldn’t have been constrained by it in the first place.

As I’m looking at the OU tree it’s actually redundant for me to check for Blue Cherry AND Citrix because every Blue Cherry OU that’s also Citrix is downstream of a VDA OU, so excluding just VDA excludes all combinations of Blue Cherry and Citrix. (I just didn’t want to rely on that in case somebody in the future makes a Blue Cherry + Citrix OU that isn’t downstream of a VDA OU.)

Anyway, it’s moot now, thanks for trying to help me.