Refining Simple Search Based On Analytics

While a Simple Search runs, Analytics discovers problematic field values in the events, color-codes them in each event, and also displays a list of these problematic field values in the Augmented Search Pane under Analytics Insight. The color-coded severity of each field value in the list appears to the left of each field value in the list.

You can run a refined search on the resulting events, by selecting a discovered problematic value, and then doing any of the following:

• Searching for events that include both the original search text and the discovered problematic field value (Append to query with AND)
• Searching for events that include either the original search text or the discovered problematic field value (Append to query with OR)
• Replacing the original search text with the discovered problematic field value (Replace query)

To refine simple search results based on Analytics:  

1. In the Augmented Search Pane, under Analytics Insight, choose a field value to include in your refined search. On the bottom of the list, you can click Load more to see more discovered field values.
   A graph showing the distribution of events having the discovered field value is displayed, and below it, a menu with the following options:  Append to query with AND, Append to query with OR, or Replace query.
2. From the menu, select one of the options for refining the search.
   The search query is automatically updated, and the search runs, displaying the resulting events.