You can perform a complex search to view a summary of the counts of all events that answer specific criteria, as opposed to the simple search, where you view each and every event that answers the search criteria.
During a simple search, XpoSearch extracts all the fields from the events, and displays the ten fields that appear most often in the Augmented Search Pane, under Interesting Fields. Hovering on any of these fields opens the functions that can be performed on the field.
To perform a complex search:
- In the Augmented Search Pane, under Interesting Fields, choose a field to include in your complex search. On the bottom of the list, you can click Load more to choose from other interesting fields.
A menu of functions that can be performed on the field, is displayed. - From the menu, select the function to perform on the interesting field.
The search query is automatically updated, transforming the simple search to a complex search, and the search is executed, displaying a result summary table.
Alternatively, you can type a complex search query into the Search Query Panel (see Complex Search Syntax Reference).