Re: on 5.7, why is it when I clone a filter, it works but when I create the exact same filter it fails?

Thanks Garreth,

Good point this was the AIR console, but I tried it with the Web console as well this morning and I'm getting the same results.

The filter is exactly the same as the security events filter. I can see events counting up in the "factory" filter but not in mine. Again, I can add items to group for my filter but not for the factory.