6.2 Viewing Search Results

Searches return a set of events. Users can view basic or detailed event information and configure the number of results per page. Search results are returned in batches. The default batch size is 25 results, but this is easily configured.

When results are sorted by relevance, only the top 100,000 events can be viewed. When they are sorted by time, this limitation does not exist.

6.2.1 Basic Event View

The information in each event is grouped into Initiator information and Target information. If data isn’t available for a particular event field, the fields are labeled Unknown.

Figure 6-3 Basic Event View

Occasionally, the search engine might index events faster than they are inserted into the database. If a user runs a search that returns events that have not been inserted into the database, the user gets a message that some events match the search query but could not be found in the database. Generally if the search is run again later, the events are in the database and the search is successful.

Figure 6-4 Events Indexed but Not Yet in Database

6.2.2 Event View with Details

Users can view additional details about any event or events by clicking the details link on the right side of the page.The details for all events on a page can be expanded or collapsed by using the All Details++ or All details-- link. This preference is retained as you scan through multiple pages of results or execute new searches.

Figure 6-5 Event View with Details

The event above shows the same event as in Figure 6-3 but with an expanded view that shows additional data fields that might have been populated.

6.2.3 Refining Search Results

After viewing the results of a search, it might be necessary to refine the search results and add additional search criteria. For example, you might see one initiator user’s name appear several times in the search results and want to see more events from that initiator.

To filter the search results using a specific value appearing in the search results:

  1. Identify the desired filter criteria in the search results.

  2. Click the value (for example, target hostname test1900) by which you want to filter the results.

    HINT:This adds the value to your filter with an AND operator. To add the value to your filter with an NOT operator, press the Alt key as you click the value.

  3. Click Search.

Some fields cannot be selected to refine a search this way:

  • EventTime

  • Message

  • Any field related to the Reporter

  • Any field related to the Observer

  • Any field related to TargetTrust

  • Any field with a value Unknown