If you created a derived application in Observer that you want to filter on, enclose the name of the application in single quotes.
 
 
Usage
app < 'AFP over TCP' | 'AmEx ISO 8583' | 'ArcaBook Multicast' | 'BFD Control' | 'BFD Echo' | 'BGMP' | 'BGP' | 'Bit Torrent' | 'CIFS/SMB' | 'Cisco SCCP' | 'Cisco SGM' | 'Cisco Wireless IDS' | 'Cisco-RSB' | 'Citrix CGP' | 'Citrix ICA' | 'CME RLC' | 'DAAP' | 'DCE endpoint' | 'Derived Application' | 'DIAMETER' | 'DirectEdge Multicast' | 'DNP3' | 'DNS' | 'DNS-LLMNR' | 'DNS-multicast' | 'EIP' | 'FCIP' | 'Finger' | 'FIX' | 'FLAP' | 'FTP control' | 'FTP data' | 'FTPS control' | 'FTPS data' | 'GIOP' | 'H.245' | 'H.248' | 'H.323/H.225 gate disc' | 'H.323/H.225 gate stat' | 'H.323/H.225 host call' | 'HOST2' | 'HTTP' | 'HTTPS' | 'IAX2' | 'IMAP' | 'IPFIX' | 'IRC' | 'ISAKMP' | 'ISCSI' | 'ISO_TSAP' | 'Kerberos' | 'LBT-TCP' | 'LDAP' | 'LDP' | 'LDP/LDR' | 'Lotus Notes' | 'LSE Infolect' | 'M3UA' | 'MEGACO H.248' | 'MGCP call agent' | 'MGCP gateway' | 'MINET' | 'MODBUS' | 'MS Web Discovery' | 'MSN' | 'MSRPC' | 'Multicast Pitch' | 'MySQL' | 'NCP' | 'NetBIOS name' | 'NetBIOS session' | 'NetFlow' | 'NI Observer' | 'NI OI' | 'NI Probe' | 'NNTP' | 'NNTP over SSL/TLS' | 'Other' | 'OUCH' | 'POP3' | 'POP3 over SSL/TLS' | 'PPTP' | 'PTP' | 'RADIUS' | 'RLogin' | 'RTSP' | 'Shoutcast' | 'SIP' | 'SIP over SSL/TLS' | 'SOCKS' | 'SSH' | 'SUNRPC' | 'SUNRPC-RQuota' | 'T.120/X.224' | 'T.38 FAX (1998)' | 'T.38 FAX (2002)' | 'TACACS' | 'TDP' | 'TDS-SQL' | 'Telnet' | 'Telnet over SSL/TLS' | 'TNS-Oracle' | 'VISA Cardnet' | 'WAP-WSP' | 'WAP-WTP' | 'WebSphere MQ' | 'WhoIs' | 'WhoIs++' | 'WMP-NSS' | 'X-Windows' | 'XFER' > [ /TCP | /UDP | /SCTP ]
 
 
Examples
app HTTP
app HTTP/TCP
app 'WebSphere MQ'
app 'WebSphere MQ/TCP'