You can define a data set to provide users access to specific content.

Text-based constraints are not supported for data sets.


Verify that you are logged in to the vRealize Log Insight web user interface as a user with the Edit Admin permission. The URL format is https://log-insight-host, where log-insight-host is the IP address or host name of the vRealize Log Insight virtual appliance.


  1. Click the configuration drop-down menu icon and select Administration.
  2. Under Management, click Access Control.
  3. Click Data Sets.
  4. Click New Data Set.
  5. Click Add Filter.
  6. Use the first drop-down menu to select any field defined within vRealize Log Insight.

    For example, hostname.

    The list contains all defined fields that are available statically, in content packs, and in custom content.


    Numeric fields contain the additional operators =, >, <, >=, and <=, which string fields do not. These operators perform numeric comparisons. Using them yields different results than using string operators. For example, the filter response_time = 02 matches an event that contains a response_time field with a value 2. The filter response_time contains 02 does not have the same match.

  7. Use the second drop-down menu to select the operation to apply to the field selected in the first drop-down menu.

    For example, select contains. The contains filter matches full tokens: searching for the string err does not result in error as a match.

  8. In the text box to the right of the filter drop-down menu, enter the value that you want to use as a filter.

    You can use multiple values. The operator between these values is OR.


    The text box is not available if you select the exists operator in the second drop-down menu.

  9. (Optional) To add more filters, click Add Filter.
  10. Click Save.

What to do next

Associate a data set with a user role. See Create and Modify Roles.