The Search Query Panel user interface includes the following elements:

Element	Description
	Open the Search Options window icon Clicking this icon displays a window with four links: Search History – Clicking this link opens a window that displays your recent and popular searches. Saved Searches – Clicking this link opens a window with a listing of the names of the searches that you saved. Simple Search Syntax – Clicking this link opens a window, which lists the syntax that you can use to formulate a simple search. Complex Search Syntax – Clicking this link opens a window, which lists the syntax that you can use to formulate a complex search. It also includes a Close icon for closing the Search Options window.
/	Search Status icon indicates that the search is in progress; indicates that the search is complete.
Search Query	Area for typing a simple or complex search query, or for activating a saved search query.
	Clicking this button changes it to the menu item, which you can click to open a selection of actions that can be performed on the search query: Save Search – Selecting this item saves the search query in the system. Save Gadget – Selecting this item saves the search query as a gadget. Save Monitor – Selecting this item saves the search query as a monitor. Export to PDF – Selecting this item saves the search query and results in a PDF file.
/	Close Augmented Search / Open Augmented Search buttons. By default, the Augmented Search Pane is open. Clicking the button closes the pane; clicking the button opens the pane.
Time Period	Defines the time period during which the search is to be run. Selectable time periods include: The entire time that the log exists: All Time Predefined time periods:Today, Yesterday, This Week, Last Week, Last 15/30/60 Minutes, Last 3/12/24 hours, Last 7/14 days, Last 1/3 months Customized time periods: Custom.
	Clicking this button after typing a search into the Search Query commences the search. Note: The Search button does not have to be clicked after entering a saved search or a search from history into the Search Query, changing the time period, or performing an augmented search from the Augmented Search Pane. In these cases, the search runs automatically.

Simple Search Syntax

The following table summarizes the simple search syntax:

Type	Description
Boolean	AND – A and B matches events that contain A and B. OR – A or B matches events that contain A or B. NOT – A and NOT (B or C) matches events that contain A but not B or C.
Quotation Marks	Used to get an exact match of a term. Recommended when there is a key word (such as ( ), =, and, or, not, in, , ?) within a searched term. Example:* "connection(1234) failure" -> returns events with an exact match to connection(1234) failure.
Parentheses	Used to unify a term result or to create precedence within search queries. Examples: a or (b in folder.my_folder) -> searches for events that contain a, or events that contain b in sub folders and logs under the folder my_folder. a or b in folder.my_folder -> searches for events that contain a or b in sub folders and logs under the folder my_folder. a and b or c -> precedence to the key word and, this term is equivalent to (a and b) or c. a and (b or c) -> precedence to b or c; its result and a.
Wildcards	May be placed anywhere in a search term: * – foo, foo, *foo, foo, foo** (* represents any characters, 0 or more times) ? – ?oo, fo?, f? o (? represents any character, exactly one time)
Search in a specific log/folder/application/server	Searches for a term in a specified log, folder, application, or server. Examples: error in log.my_log -> searches for error only in logs whose name is my_log. error in log.my* -> searches for error only in logs whose name starts with my. error in folder.my_folder -> searches for error only in logs under folders whose name is my_folder. error in folder.my* -> searches for error only in logs under folders whose name starts with my. error in host.my_host -> searches for error only in logs whose source name is my_host. error in host.my* -> searches for error only in logs whose source name starts with my. host.my_host is equivalent to server.my_host. error in app.my_app -> searches for error only in logs associated to applications whose name is my_app. error in app.my* -> searches for error only in logs associated to applications whose name starts with my. app.my_app is equivalent to application.my_app.
Column-based Search	Searches for events that have a specific value in a specific column of the log. Examples: column_name=search_value -> searches for events that have a column named column_name whose value is equal to search_value (relevant only for logs that have a column with that name). column_name=search_value in log.my_log -> searches for events in the log my_log that have a column column_name whose value is equal to search_value (relevant only if the log has a column with that name). column_name contains search_value -> searches for events that have a column named column_name whose value contains search_value (relevant only to logs that have a column with that name). column_name contains search_value in log.my_log -> searches for events in the log my_log, which have a column column_name whose value contains search_value (relevant only if the log has a column with that name).
Regular expression search	Searches in events for values represented by regular expressions. Example: regexp:\d+ in log.access -> searches for numbers in events.
Activate saved search	Activates a search that you previously saved. search.search_name -> runs the saved search called search_name.