fix: keep raw protocol numbers in NetFlow bare-term search

The previous commit replaced the protocol number with its name in the
default full-text expression, so a bare "17" stopped matching UDP flows.
Search both the number and the name.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Valery Petrov

packages/common-utils/src/__tests__/netflowSource.test.ts

@@ -83,6 +83,9 @@ it('searches mapped NetFlow dimensions for bare Lucene terms by default', () =>
   expect(config.implicitColumnExpression).toContain('toString(SrcAddr)');
   expect(config.implicitColumnExpression).toContain('toString(ExporterName)');
   expect(config.implicitColumnExpression).toContain('toString(OutIfName)');
+  expect(config.implicitColumnExpression).toContain(
+    "ifNull(toString(Proto), '')",
+  );
   expect(config.implicitColumnExpression).toContain(
     netflowProtocolNameExpression('Proto'),
   );

packages/common-utils/src/core/searchChartConfig.ts

@@ -61,6 +61,7 @@ function getNetflowImplicitColumnExpression(source: TNetflowSource): string {
     source.dstAddrExpression,
     source.srcPortExpression,
     source.dstPortExpression,
+    protocol,
     protocol && netflowProtocolNameExpression(protocol),
     source.exporterExpression,
     source.inIfExpression,