When a Simple Search is performed, analytics Analytics (provided that it is enabled) discovers problematic field values in the events, color-codes them in each event, and also displays a list of these problematic field values in the Augmented Search Pane under Analytics Insight. The color-coded severity of each field value in the list appears to the left of each field value in the list.
You can run a refined search on the resulting events, by selecting a discovered problematic value, and then doing any of the following:
- Searching for events that include either that include both the original search text or and the discovered problematic field value (Append to query with ORAND)
- Searching for events that include both that include either the original search text and or the discovered problematic field value (Append to query with ANDOR)
- Replacing the original search text with the discovered problematic field value (Replace query)
To refine simple search results based on
...
Analytics:
- In the Augmented Search Pane, under Analytics Insight, choose a field value to include in your refined search. On the bottom of the list, you can click Load more to see more discovered field values.
A graph showing the distribution of events having the discovered field value is displayed, and below it, a menu with the following options: Append to query with AND, Append to query with OR, or Replace query. - From the menu, select one of the options for refining the search.
The search query is automatically updated, and the search is executed, displaying the resulting events.