When While a Simple Search is performed, analytics (provided that it is enabled) runs, Analytics discovers problematic field values in the events, color-codes them in each event, and also displays a list of these problematic field values in the Augmented Search Pane under Analytics Insight. The color-coded severity of each field value in the list appears to the left of each field value in the list.
You can run a refined search on the resulting events, by selecting a discovered problematic value, and then doing any of the following:
Searching for events
that include eitherthat include both the original search text
orand the discovered problematic field value (Append to query with
ORAND)
Searching for events
that include boththat include either the original search text
andor the discovered problematic field value (Append to query with
ANDOR)
Replacing the original search text with the discovered problematic field value (Replace query)
To refine simple search results based on
...
Analytics:
In the Augmented Search Pane, under Analytics Insight, choose a field value to include in your refined search. On the bottom of the list, you can click Load more to see more discovered field values.
A graph showing the distribution of events having the discovered field value is displayed, and below it, a menu with the following options: Append to query with AND, Append to query with OR, or Replace query.From the menu, select one of the options for refining the search.
is executed
The search query is automatically updated, and the searchruns, displaying the resulting events.