When a Simple Search is performed, analytics (provided that it is enabled) discovers problematic field values in the events, colorcodes them in each event, and also displays a list of these problematic field values in the Augmented Search Pane under Analytics Insight. The color-coded severity of each field value in the list appears to the left of each field value in the list.
You can run a refined search on the resulting events, by selecting a discovered problematic value, and then doing any of the following:
- Searching for events that include either the original search text or the discovered problematic field value (Append to query with OR)
- Searching for events that include both the original search text and the discovered problematic field value (Append to query with AND)
- Replacing the original search text with the discovered problematic field value (Replace query)
To refine simple search results based on analytics:
- In the Augmented Search Pane, under Analytics Insight, click the field value to include in your refined search.
A graph showing the distribution of events having the discovered field value is displayed, and below it, a menu with the following options: Append to query with AND, Append to query with OR, or Replacy query. - From the menu, select from the menu, one of the options for refining the search.
The search query is automatically updated, and the search is executed, displaying the resulting events.