- Search Overview
- Search Home Page
- Performing Searches
- Basic Search
- Advanced Search
- Advanced Search Building Blocks
- Running an Advanced Search Query
- Query Syntax
- Query by Subject
- Query by Vendor and Product
- Query by Field and Value
- Query by Context Table
- Query Using Regex
- Free Text Search
- Query Using Advanced Query Language Operators
- Query Using Aggregation Functions
- Query Using Structured Fields
- Dynamic Field Extraction
- Natural Language Search
- Anomaly Search
- Refine a Search
- Context Tables in Search
- Search Best Practices
- Search Results
- Dashboard Visualizations
Query Syntax
The following table shows the accepted logical statements and syntax for querying in Search. Search semantics applies a limited subset of Lucene.
Note
Note that AND
, TO
, NOT
, and OR
are case-sensitive operators (i.e. all upper-case only).
Search Types | Operator Descriptions | Example Syntax |
---|---|---|
Empty String | Leave the search bar empty. | Leaving the search bar empty will query all logs, and return all results. |
Literal Terms | Alpha-numeric text to search for. "" |
Look for log fields containing the text Web. This is case-insensitive. This will find records with the strings |
Fields | Data type or category name (i.e. key within [key,value] of structured data). | Search for any fields and values using one of the following methods:
For detailed information about field search syntax, see the following syntax tables: Generic Field Search Syntax and Field Search Syntax for Specific Data Types. |
List of Values | Comma separated (item 1, item2, ... ,itemN) | When doing a multi-value search, the values must be in parentheses.
or
or
Looks for the strings where the value of subject is in the set ("alert", "datastore") This is equivalent to |
IP CIDR Notation | Query for a range of IP Addresses using CIDR notation. |
or
Search within the range of IPs from 192.0.0.0 to 192.0.0.15 |
Timestamps | Use any of the following syntax options to look for specific timestamp ranges:
Search does not support an exact match on time fields (only time ranges). |
|
Range Search
| Range of values with lower and/or upper limits, expressed as numeric values.
OR
|
NoteRanges are inclusive. [10 TO 50] means 10 and 50 are included in the search results.
|
Operators | Joining of two or more criteria:
|
Look for records with both
Look for records with either |
Negative Terms
| Term must not exist. |
Look for records with |
Grouping
| Multi-term search processed first by criterium set in parentheses. | Parentheses are supported for grouping expressions.
Look for records with a NoteLimitations:
|
Regex | For complex search queries, use Regex (RGX) Operators. | |
Wildcards | The wildcard symbol, "*" is not allowed in search queries as a standalone expression, but could be used with Wildcard (WLD) Operators. |