- Search Overview
- Search Home Page
- Performing Searches
- Basic Search
- Advanced Search
- Advanced Search Building Blocks
- Running an Advanced Search Query
- Query Syntax
- Query by Subject
- Query by Vendor and Product
- Query by Field and Value
- Query by Context Table
- Query Using Regex
- Free Text Search
- Query Using Advanced Query Language Operators
- Query Using Aggregation Functions
- Query Using Structured Fields
- Dynamic Field Extraction
- Natural Language Search
- Anomaly Search
- Refine a Search
- Context Tables in Search
- Search Best Practices
- Search Results
- Dashboard Visualizations
Search Results
When a search has completed, the results of your search are displayed directly below the Search Bar, including a timeline view of events, and an events list. The most recent events that match the query are displayed in the Events List. The total number of events is presented at the top.
Note
Search will scan the data until it reaches 500M matches and then will stop scanning. The search results will reflect these first 500M events only. In these instances, the total number of events displayed at the top will show 500M+ results.
Note
If you have a Long-Term Search license, note that Search can only return long-term search results that are within the licensed capacity. Results from data that exceeds that volume will not be returned. For information about tracking long-term search consumption, see Long-Term Search in the Service Health and Consumption guide. For information about setting log retention periods, see Global Log Retention in the Search guide.
