Search best practices

Use a list and refer to it instead of repeatedly using arrays.

Regular expression (regex) operations can be performed against a maximum of 50,000 events for each search in Helix. To perform regex operations against larger datasets, you must filter search results to fewer than 50,000 events. Otherwise, the search will not complete successfully.

Encapsulate all string patterns with single or double quotation marks to help ensure that Helix accurately interprets the string. For example:

Using spaces and special characters within a rawmsg string pattern can result in inconsistent search results. To avoid this, either encapsulate single words with quotation marks as noted above or use the AND operator between words. For example:

Using : (contains) instead of = (exact match) is recommended for inexperienced users.