...
- In the Search Results Area, hover over a column value of an event, and after it is highlighted, click it.
A list of operations opens. - Select one of the following operations:
Add to Search (AND) – To search for events matching the current search query AND the highlighted value in the event.
Add to Search (OR)– To search for events matching the current search query OR the highlighted value in the event.
Exclude from Search – To search for events matching the current search query, with the exception of those events that have the highlighted value in the event (AND NOT).
Replace Search – To replace the search query with the highlighted value in the event.
In the first three operations, the highlighted value is added to the current search query with AND, OR, or AND NOT, respectively. In the last case, the search query is replaced with the highlighted value.
The new search runs.
The added search condition appears under Active Filters in the Augmented Search Pane. - Repeat steps 1 and 2 for all event values to use to refine that you want to include in your search query.
At any point, you can restore the original query, or remove from the query a filter based on an event, by removing it from the Active Filters list .
Removing a Filter From the Search Query
From the Augmented Search Pane, under Active Filters, you can remove a filter that you added to the search query based on an event.
Removing the filter from the Active Filters list removes it from the search query, and automatically runs the search with the resulting query.
To remove a filter from the search query:
- In the Augmented Search pane, under Active Filters, click the Remove Filter icon adjacent to the filter that you want to remove.
The filter is removed from the Active Filters list, and the resulting search query runs.
Resetting the Search Query
You can reset a search query to its original state, regardless of the number of filters that have been added to it.
To reset a search query:
- In the Augmented Search pane, under Active Filters, click Reset.
The Active Filters list closes, and the original search query is reinstated, and automatically runs.
...
- (see Managing Active Filters).