Simple Search Results Area

Search Results Summary Panel

A panel that summarizes the results of the search, and provides navigation to the result event pages.

Events Toolbar

Includes icons for expanding/collapsing events and for disabling/enabling Analytics.

Events Area

A list of the events that match the search query.

Search Summary

In the case of a simple search, displays the number of matching log events, the number of source logs of these events, and the period of time searched.

In the case of a complex search, displays the number of results in the table, the number of events that the results are based on, the number of source logs of these events, and the period of time searched.  

Previous matching events icon.

Clicking this icon displays in the Result Page Navigation Area, the numbers of the previous ten pages, and displays the first of these pages in the Search Results Area.

Next matching events icon.

Clicking this icon displays in the Result Page Navigation Area the numbers of the next ten pages, and displays the first of these pages in the Search Results Area.

Results Page Navigation Area 

Displays the page numbers of up to ten pages of results. You can display the previous/next ten page numbers, by clicking the / icons.

Clicking a page number displays that page of results in the Search Results Area. The current page number is highlighted in white.

Expand all Events / Collapse all Events icons.

Clicking the icon expands all events to display all their column names and respective values.

Event timestamp

The date and time that the event occurred, in the format MM/DD/YYYY HH:MM:SS

Analytics layer

If Analytics is active, colors the fonts of the column values that Analytics detects as problematic, according to the following color-coding:

• Red – high severity problem

• Orange – medium severity problem

• Yellow – low severity problem

Under the timestamp, displays the severity of the most severe column value detected by Analytics in the event: high, medium, low, or none.

Event structure

The structure of the event, including its column names and respective column text, in the format ([COLUMN_NAME] COLUMN_TEXT).

Event source fields

Shows the source of the event – the log, server, and/or applications which generated the event. Mouse over on the log source indicator [Log] presents the full path of the source log that this message originates from.

Expand Event icon.

Appears at the end of an event that can be expanded to show all its column names and respective values. 

Clicking the icon expands the event to display all its column names and respective values.

Mouse Over Options

Mouse over on search results (and columns names) presents two optional action:

Search Actions - Clicking this icon presents a list of possible search actions on the highlighted phrase: append to current search using AND, append to current search using OR, excluding from current search, replacing the current search.