Data LakeData Lake User Guide

At the top of the page is a search bar where you can enter a simple text search or use the Lucene query syntax to search your data. The total number of matching events are shown above the toolbar. To the right is a drop-down time filter that you can use to filter logs based on various relative and absolute time ranges.

Next to the time filter is a SAVE button that allows you to save searches - this function saves both the query string and the currently selected index pattern.

Clicking on LIBRARY opens a drop-down box that contains all of your saved searches, visualizations, and dashboards. Clicking on a saved search will populate the Search Bar with the saved query and launch the search.

For searches that have run a long period without timing out (for example, a search on a small data set that does not complete within 5 minutes) or you have initiated in error, you can halt the query by clicking the cancel icon that appears when the search starts:

If your query string extends beyond the length of the search bar, the text will wrap to the next row. To view the whole expanded query, click ... located in the lower right corner of the search bar. Click elsewhere outside the search bar to collapse the expanded view.

To initiate a query with hot-keys, use Control-Enter.

When you submit a search request, the Timeline, Events Table, and Fields update to reflect the search results. The most recent events that match the query are listed in the Events Table. You can use this to look at individual log messages and display log data filter by fields. If no fields are selected, then the entire log is displayed.

Every event returned in the search results list consists of four sections. Here is an example of an Enhanced view of a log:

The Table view allows you to create your own table with fields of your choosing, to be arranged as you see fit.

While viewing in Table view, sort the results according to a single column or multiple columns by clicking SORT COLUMNS or by clicking the arrow next to any column name.

Use the SORT COLUMNS menu to select the columns by which you want to sort data in the table. You can configure each column to sort by ascending or descending order. Additionally, you can sort search result tables on the Search page and data tables on the Visualizations by multiple columns.

Use the Share button to create a shortened URL which links directly to the current search results table. Click COPY to copy and share the snapshot link with members of your organization who have access to the Data Lake UI.

Use the Export button to save your search results as a PDF or a CSV file. Export limits will apply to large volume search results. For more information on export format, see Export Limits for Large Volume Exabeam Data Lake Query Results .

For each log event, select the More Options icon () to open the submenu for export options:

The Timeline View is a date histogram bar graph that shows the count of logs over time, matched by the search and time filters. You can click on the bars to narrow the time filter.

To set a Time Filter from the histogram, do one of the following:

The histogram lists the time range you’re currently exploring, as well as the interval range that is being used. To change the intervals, click the link and select an interval from the drop-down. The default behavior automatically sets an interval based on the time range.

You can narrow your search further using the Time Picker tool. See Selecting a Timeframe.

You can collapse or display the Timeline by clicking the Open/Close icon.

Selecting a Timeframe in Exabeam Data Lake Search Results

The time filter restricts the search results to a specific time period. You can set a time filter if your index contains time-based events and a time-field is configured for the selected index pattern. By default, the time filter is set to the last 15 minutes. You can use the Time Picker to change the time filter or select a specific time interval or time range in the timeline view at the top of the page.

For all time-based data, you can select the time span that you want to analyze in the current view at the top right of the window. There are multiple ways to get to the events you are interested in: either use the Quick tab to select a date range like Today or Last 1 hour or use the Relative and Absolute tabs to specify more specific time spans you want to look at.

After you select a time range, you will see a timeline view at the top of the screen, which will show the distribution of events over time.

To use the Time Picker, either drag your mouse over a specific span of time.

Or, you can select a bar on the timeline that represents the time interval you want to zoom in on.

Data Lake displays a list of fields that found in the events of the search results, at the left of the UI. You can click the field to add a column containing the contents of this field to the table. No matter what fields you have added as columns, you can always expand a row on the caret in the front. You can also remove fields that you don’t want to see as columns anymore in the section Selected Fields above the field list on the left.

You can expand any field in the fields list on the left by clicking on it. It will reveal the list of the most common values for that field. Use the – and + magnifier icons to quickly add a filter to show only events containing that value (+) or to exclude all events with that value (-).

If you add filters that way, this field will be added as a search term within the query.

Filters can also be set by expanding the table rows on the right which show the event contents and using the filter buttons which appear there. Note that events may contain fields which are not indexed and can thus not be used for filtering. You won’t find any filter buttons for those.

Additionally, click the View field visualization link to create a new visualization from a single selected field. Once the new visualization is created, you can further customize the view by adding or removing top terms you want to review.

Please see the Visualize section for more information on creating, managing, and reviewing your visualizations.

Field Explorer

In addition to using manually created search strings, users have the option to filter data using out-of-the-box filters available in the Search UI.

The Field Explorer is the quick pick tool for viewing captured data in known categories (both out-of-the-box and custom filters). Click on the hyperlink for a given sub-category and menu of known values are listed to filter further. View field visualization can be selected to immediately visually organize data from the shown list.

Data Lake accepts searches in the Lucene query language. This section covers some of the basic operators for conducting searches.

The following is the sorting order using in Data Lake. Note that leading spaces are given greater weight than all other character or number when records are sorted.

Ascending order is:

Descending order is:

The reverse of the above.

The following is an example of ascending order:

Data Lake supports multiple categorization attributes for each log or event type defined in the product. Different vendors use different fields and terms in their logs.

Categorizing events provides a consistent taxonomy for queries, reports, visualization, dashboard, search, and correlation rules. Our out-of-the-box compliance reports leverage this nomenclature.

For example, a log has the following value:

exa_activity_type: authentication/local_logon

This log will also be returned in the query:

exa_activity_type=authentication

Current categories are:

Examples:

exa_activity_type = account-management/user/create

exa_device_type = operating-system/network/firewall

exa_outcome = success/allow

For a complete list of Exabeam event categories, see the "Searches using Exabeam exa_category" section in How to Run Query Searches in Exabeam Data Lake.How to Run Query Searches in Exabeam Data LakeHow to Run Query Searches in Exabeam Data Lake

Saving searches enables you to reload query results quickly and use them as the basis for Visualizations, Dashboards, and Reports. A search can be saved into a library by clicking on the SAVE. You can access the search library at any time to get a list of all your saved searches. Selecting a saved search will populate the search box with the query and launch the search.

To Save the Current Search:

To Open a Saved Search:

To Edit or Delete a Saved Search:

The search library contains a list of all saved searches.

To edit a saved search:

If you selected CREATE NEW SEARCH when creating a new report, the Search landing page will be opened.