After completing a search, you may find data of interest within a parsed field of an event in your search results. You may want to refine your search or run a new search for the same data in other events.
To use event data to refine a search or run a new search:
From the main menu, select Investigate > Search.
In the search results, click the cell containing the data of interest, or select a row to open the side panel.
Choose from the options in the following table.
Option
Description
Add to Query
Adds the data to the current query in the Search bar.
New Search
Searches for the same data in other events. A new query appears in the Search bar, which you can either run as is or modify and then run.
Exclude from Query
Exclude the data from the current query in the Search bar. The value is added to the current query as a NOT statement.
Group by Field
Groups search results by the selected field. The value is added to the current query, for example
groupby class.Copy Cell to Keyboard
Copies the data to the clipboard for use in another query, another application, or your notes.