How many characters does Netwitness query filtering able to afford?

[XueYQ]

My rules is to check for hits from the list, which the list might contains quite a huge data. 

For example the rule is: ip.dst = $

List: 1.1.1.1, 2.2.2.2,......, etc.

When I drill in to particular hits, the query should be: (ip.dst = 1.1.1.1, 2.2.2.2, ....... +2000 character).

But it end up to be: (ip.dst = 1.1.1.1, 2.2.2.2, ......., 56.56.56.56

It stops half way. And having issues of syntax error, which in this case is due to the "(".

[JohnSnider]

if you are doing this query in RE, then you need to tag the IP's first using a feed, lists should not exceed about 100 entries).  Create a feed from the list to tag the IP addresses in a metakey (I usually create a couple of custom metakeys for my customers, like "customer.info" and "customer.alert" (the "customer" part is usually the Company initials, or a Security team code like CIRC or SOC) and use the .info key for putting values in from rules tagging data for use in alerts of RE/ESA rules) so in your case, create an ip.dst feed to match the list of IP's and create a value in "customer.info" that relates to the rule, like "watchlist_ip", then your RE rule would be: customer.info = 'watchlist_ip'