Keywords and Operators for Simple Searches

Both historical and real time searches have a simple search option that searches for keywords in the raw ASCII tex of event logs. You can use operators in your keyword searches to combine terms or create simple search filters.

Keyword Operators

Examples of Using Keyword Search Operators

Quotes and Backslash Characters in Search Terms

Keyword Operators

You can use the operators AND, OR, AND NOT between keywords. If you enter more than one keyword, then AND is assumed as the operator between them. You can also use parentheses () to change the precedence of the operators.

Examples of Using Keyword Search Operators

Search String	Results
TCP	Finds all events with TCP in the event logs
TCP 80	Finds all events with TCP and 80 in the event logs
TCP AND (80 OR 443)	Finds all events with TCP and 80 or 40 in the event logs
TCP AND NOT 80	Finds all events with TCP but not 80

Quotes and Backslash Characters in Search Terms

If the search string contains quotation marks or back-slash characters, you must escape them by prefixing them with a backslash character. For example, if you wanted to search for [location]=”United States” then you would need to enter [location]=\”United States\” as your search string.

Using Expressions in Structured Searches and Rules

An expression can contain a single event attribute, multiple attributes, or functions that contain an event attribute as their argument. You can also use parentheses and arithmetic operators to form complex expressions.

You can enter an expression manually, paste it in, or build it dynamically using the Expression Builder. If you use the Expression Builder, you will have to enter parentheses or arithmetic operators in the expression.

The Expression Builder

Creating Expressions

Adding a Function

Filter Condition Functions

Aggregation Condition Functions

The Expression Builder

You can access the Expression Builder by clicking the e icon next to the Attribute or Value field when creating a structured search or rule.

This screenshot shows the Expression Builder open for creating a rule.

Creating Expressions

Adding a Function

To add a function to the expression, select it from the Add Function menu, and then click the + icon. The available functions depend on whether you are are creating an expression to use as part of a filter condition for a search or rule, or as part of the aggregation conditions for a rule.

Selecting Function-Specific Attributes

When you select any type of function, the function and a set of parentheses will be added to the expression. If you place your cursor within the parentheses and then open the Event Attribute menu, you will see event attributes that are relevant for that function. For example, if you select COUNT as the function, (MATCHED ITEMS) will automatically appear between the parentheses, and will be selected in the Event Attribute menu. If you select a function like AVG for an aggregation condition, you will see options such as CPU UTIL and Apache Uptime. If you select a function like HourOfDay for a filter condition, you will see options like Access Time and Vul nerable Since. You can search through the options in either situation by beginning to type a keyword in the Event Attribute menu. Sele cting Attributes for Structured Searches, Display Fields, and Rules has more information about ways to search for and select event attributes.

Filter Condition Functions

If you select HourOfDay or DayOfWeek for the function, the Event Attributes menu will contain date and time-related event attributes, while if you select DeviceToCMDBAttr, it will contain device-related attributes.

Function	Description
HourOfDay	Specify an hour of the day in the condition
DayOfWeek	Specify a day of the week in the condition
DeviceToCMDBAttr	If you add the DeviceToCMDBAttr() function to the expression, the first argument must be an event attribute, and the second argument must be a CMDB attribute, which you can select using the CMDB Attribute menu. The DeviceToCMDBAttr function is used to create expressions for per-device thresholds.

This screenshot shows the beginning of creating an expression to use as the Attribute in a condition for an historical search. HourOfDay is selected as the Function, and Access Time is selected as the Event Attribute.

Aggregation Condition Functions

You use these functions to perform operations on numerical event attributes such as Sent Bytes, Received Bytes, CPU Utilization, or Memory Utilization.

Function	Description
Count	Count the number of items returned
Count Distinct	Count the number of distinct items returned
Sum	Add the numbers
Average	Average the numbers
Min	The lowest number
Max	The highest number
Last	The last number
First	The first number
Pctile95	The 95th percentile
PctChange	Percentage change
STAT_AVG	Statistical average. This function is used in conjunction with creating baseline reports.
STAT_STDDEV	Statistical standard deviation. This function is used in conjunction with creating baseline reports .

This screenshot shows the beginning of creating an expression to use as an aggregation condition in rule. Max is selected as the Function, and CPU Util is selected as the Event Attribute.

Selecting Attributes for Structured Searches, Display Fields, and Rules

For both Real Time and Historical structured searches you have the option to to select event attributes to use in both your search and Group By fi lters, and as display fields in your result lists. Since AccelOps recognizes over 130,000 event attributes, the documentation and user interface provides several ways to find the attributes you want to use. These instructions show how to access the Common Attributes menu and the CMDB attribute browser through the Attributes in search conditions, but you can access the same functionality in the Display Fields menu for searches, and when you create a new rule. They also contain information on how you can access the attributes associated with reported events through the Raw Event Logs column of results lists.

The Event Dictionary and Master Attribute List

Selecting Attributes in the Common Attributes Menu

Selecting Event Attributes from the CMDB

Selecting Attributes from the Raw Events Log Column of the Results Lists

The Event Dictionary and Master Attribute List

This documentation includes an Event Dictionary that describes events and their attributes, and an attribute master list, which lists the primary event attributes and their data type, along with a brief description of what values AccelOps expects to see when that attribute information is returned.

Selecting Attributes in the Common Attributes Menu

This screenshot shows the Common Attributes menu open in the Conditions Builder for an Historical search. Open the menu by clicking the downward arrow next to an Attribute text field. You can scroll through the list of event attributes to select the one you want, or begin typing an attribute name and the menu will sort based on your entry.

Selecting Event Attributes from the CMDB

You also have the option to browse all the attributes listed in the CMDB to find the one that you want. These two screenshots show the CMDB attribute browser, which you can access by clicking … next to the Attribute text field.

The first screenshot illustrates browsing the CMDB attributes based on Device Type and Feature Type: Availability, Change, Performance, Se curity, and All. In this example, Security has been selected for Feature Type, and Cisco IOS has been selected for Device Type. This loads all the security attributes associated with the Cisco IOS into the Attribute List.

The second screenshot illustrates browsing the CMDB Event Types to find an event attribute. In this example, Cisco ASA is selected for Device Type. Clicking in the Event Type window opens an Event Browser for the CMDB. Select any group in the browser, and you will see the event types within that group that are applicable to the Device Type you selected.

Selecting Attributes from the Raw Events Log Column of the Results Lists

All real time search results lists include a Raw Event Log column, and you can add a a Raw Event Log column to the list of results for historical searches. In addition to providing detailed information from the raw event logs, you can also use this column to view all the attributes associated with a reported event and add them to the display fields in your results list or to your filters for structured searches.

1. Cilck in the Raw Event Log column of your results list to collapse the view.

The raw event log text will collapse into an information icon with a blue +.

2. Click on the blue + icon to open the Event Details.

You will see the raw event log text and list of all the attributes associated with that event type.

3. Select Filter or Display to add an attribute to the search filters or display fields for that search.
4. Click X to close the Event Details window when you’re done making your selections.

 

 

 

Structured Search Operators

Operator	Meaning	Allowed on Event Attribute Types or CMDB Group	Example as seen in GUI
=, !=	Compares whether an attribute is exactly identical or not identical to a specified value	All except DATE types	Event Type = “PH_DEV_MON_SYS_CPU_UTIL” Source IP != 10.1.1.1
>, >=, <, <=	Compares whether an attribute is less or greater than a specified value	Numeric types: UINT16, UINT32, UINT64, DOUBLE	CPU Util > 10
IN, NOT IN	Determines whether an attribute belongs or does not belong to a set of values. For string valued attributes, the match is case insensitive.	All except DATE type Allows CMDB Groups	System Event Category IN (3,6) Event Type IN (“PH_DEV_MON_SYS_CPU_UTIL”,”PH_DEV_MON_SYS_MEM_UTIL”) Event Type IN (“PH_DEV_MON_SYS_CPU_UTIL”,Event Types:Login Failure) Source IP IN Devices:Windows, Devices:Unix Destination IP IN Networks:VPN Pool
BETWEEN, NOT BETWEEN	Determines whether an attribute is between a range of values	All except STRING types	Source IP BETWEEN (10.1.1.1, 10.1.1.255) CPU Util BETWEEN (20.0, 30.0) Event Receive Time BETWEEN (18:35 03/17/2014, 18:35 03/26/2014)
IS (NULL), IS NOT (NULL)	Determines whether an attribute is present or not	All types	Host Name IS NOT NULL
CONTAINS, NOT CONTAINS	Determines whether a string valued attribute contains a specified sub-string. For Raw Event Log – the sub-string has to contain the beginning of every word For all other string type attributes: the sub-string can be in any  position	STRING	Event Type CONTAINS “DEV_MON” matches “PH_DEV_MON_CPU” Event Type NOT CONTAINS “DEV_MON” does not matche “PH_DEV_MON_CPU” Reporting Model CONTAINS “dows” matches “Microsoft Windows” Reporting Model CONTAINS “soft win” matches “Microsoft Windows” Raw Event Log CONTAINS “dows” does not match “Microsoft Windows” Raw Event Log CONTAINS “microsoft win” matches “Microsoft Windows 2003” (For more general patterns use regular expressions)
REGEXP, NOT REGEXP	Determines whether a string valued attribute matches a specified pattern. Raw message needs to be UTF-8 encoded.	STRING	Raw Event Log REGEXP “\d+.\d+\d+.\d+” Event Type NOT REGEXP “PH_DEV_MON_.*” – match events with event types not beginning with PH_DEV_MON

Real Time Search

You can use Real Time search to view events as they are occurring in real time within your IT infrastructure. You can use both simple and structured search criteria, as you would with historical search, but instead of the results displayed in a report like you would see with an historical search, real time search results are displayed as a rolling graph and summary of events that you can drill down into.

Overview of the Real Time Search User Interface

Creating a Simple Real Time Search

Creating a Structured Real Time Search

Viewing and Refining Real Time Search Results

 

Overview of the Real Time Search User Interface

The real time search interface is very similar to the interface for historical search, with the exception that real time search doesn’t have an option to set a search time period. As with historical search, you can also run simple or structured search queries. The main difference between historical and real time search is that real time search displays your results as they are occurring in your IT infrastructure, with a scrolling chart and summary of the results.

Simple Real Time Search

Simple Real Time Search Interface Controls Structured Real Time Search

Simple Real Time Search

When you use simple real time search, you enter a keyword to search for in the logs collected by AccelOps, set any columns you want to display in the Raw Event Log Results Summary, and, for multi-tenant deployments, select any organizations you want to filter the results for. You can then select results in the real time chart to use for historical searches, or you can select results in the Raw Event Log Results Summary to learn more information about them or use them as filters in refining your search.

This screenshot shows the results for searching the raw event logs for occurrences of TCP.

Simple Real Time Search Interface Controls

Ui Control	Description
Filter Criteria	For simple real time search, use the search box to find keywords in raw event logs. You can also create a rule from your search results.
Set Summary Display Columns	Select which columns will be displayed in the Raw Event Log Results Summary
Organizations Filter	For multi-tenant deployments, select which organizations you would like to filter the results for
Real Time Chart	Displays results as they occur in real time. Use the Pause, Fast Forward, Stop, and Clear buttons to control the display.
Raw Event Log Results Summary	Displays a summary of the raw event logs for your search results in real time. Click Pause in the real time chart and then select an item in the summary results to view attributes such as Reporting and Destination IP, add an IP address to a watch list, add an attribute as a search filter, or get topological information about network devices. Selecting a result from the summary list also enables the Filter, Quick Info, and Locations buttons.

Structured Real Time Search

For structured real time search, you only enter the filter conditions that you want to use, instead of having to also specify aggregation and group by conditions as you would in a structured historical search.

This screenshot shows the Conditions dialog for structured real time search. You can select attributes and create expressions to use in structured real time search the same way you would in structured historical search.

This screenshot shows the Conditions dialog after having selected Structured in the search controls, with two search conditions set.

 

 

 

Creating a Simple Real Time Search

1. Log into your Supervisor node.
2. Go to Analytics > Real Time Search.
3. In Filter Criteria, select Simple.
4. Enter the keywords you want to search for in the raw event logs collected by AccelOps.

See Keywords and Operators for Simple Searches for more information about keyword searching.

5. Select the Display Fields for the results summary.

See Selecting Attributes for Structured Searches and Display Fields for more information about selecting attributes that can be displayed for reported events.

6. For multi-tenant deployments, select any Organizations that you want to filter the results for.
7. Click Search.

Related Links

Keywords and Operators for Simple Searches

Selecting Attributes for Structured Searches, Display Fields, and Rules

Creating a Structured Real Time Search

1. Log in to your Supervisor node.
2. Go to Analytics > Real Time Search.
3. For Filter Criteria, select Structured.

The Conditions search window will open.

4. Click the downward arrow in the search window to open the Conditions Alternatively you can click … to use a saved Filter Criteria Set.
5. Under Conditions, set the Attribute, Operator, and Value for your condition.

You can also use expressions as search conditions. See Using Expressions in Structured Searches and Rules for more information, and Selecting Attributes for Structured Searches, Display Fields, and Rules for more information about using attributes in conditions.

6. Click + under Row to add another condition, and set the Next Operator to use for that condition.

You can give precedence to conditions by setting parentheses around them with the + button under Paren.

7. Click OK.

You can also click Save as Filter Criteria Set, and these conditions will be available for future searches by clicking … next to the search window.

8. Under Display Fields, select the attributes you want to use as the columns in your results list.

See Selecting Attributes for Structured Searches, Display Fields, and Rules for more information about selecting attributes for devices and events to use as display fields.

9. For multi-tenant deployments, select the Organization you want to run the search against.
10. Click Search.

The results of your search will appear in the real time chart and results list.

Viewing and Refining Real Time Search Results

When your real time search runs, you will see the results represented as a scrolling chart across the top of the search results window, and as a scrolling list in the bottom of the window that include the raw event log information for events matching your search criteria. You can select items in the scrolling chart to use in historical search, view more information about individual items in the results list, and add attributes from your search results to your search filters or display fields.

Selecting Results for Historical Search

Viewing Information about Real Time Search Results

Adding Search Results to Search Filters. Watch Lists, or Display Fields

Selecting Results for Historical Search

1. When you see a time interval of events that you want to use for historical search appear in the scrolling chart, click Pause or Stop.
2. Hover your mouse cursor over the bar that represents the time interval until you see the time interval information appears, and then double-click on the bar.
3. The time interval and Event Type will be added to the criteria for an historical search.

Complete the other criteria you want to use for the search as described in Historical Search.

Viewing Information about Real Time Search Results

1. When you see an event appear in the search results list that you want more information about, click Pause or Stop.
2. Select the event row and click Quick Info to view the Reporting IP, Event Type, Source IP, and Destination IP for that event.
3. To view information about specific attributes of an event, click in the attribute display field and click Quick Info.

For attributes associated with devices, this will open the Quick Info view of the device as described Summary Dashboard User Interface Overview. For events types, it will show info such as the severity and device associated with the even type.

4. To view information about a device’s location in the network topology, select it in the display field and then select Topology.

Adding Search Results to Search Filters. Watch Lists, or Display Fields

With a search result selected in the results list, click Filter to select event attributes to add to the search filter.

In the expanded Raw Events Log, click on items in the text string to include or exclude them as search filter criteria.

To add a specific result to the search criteria, in the results list, click on an item in a display field to open the options menu, and then select Add to Filter.

To add an IP address to a watch list, click on it to open the options menu, and then select Add to Watch List.

See Watch Lists for more information.

See the section on Selecting Attributes from the Raw Event Log Column in the Results Lists in the topic Selecting Attributes for Structured Searches and Display Fields for information on how you can view and select the attributes associated with events to use as search filters or display fields from the real time search results list.

 

 

 

 

Converting an Historical Search to a Rule

Example

Procedure

Example

While using historical search, you may observe a pattern that you want to use as a rule so if the pattern recurs, it will trigger an alert. For example, in an historical search you may notice excessive traffic going outside your country or the countries you do business with. You can generate a rule to watch for this traffic pattern from within the historical search.

These screenshots show the conditions and results for the example of an historical search for excessive outgoing traffic.

Following this example, you may now want to create a rule that will send you an alert when a particular source sends more than 1000 connections, or more that 5MB of traffic, in five minutes.

Procedure

1. In the historical search that you want to use as the basis for your rule, click Create Rule.

The Rule Editor will load, with most information for the rule auto-populated from the search. You can also read the topics under Rules for more information about creating rules.

2. Enter a Rule Name and Description.
3. Set the Severity to associate with incidents generated by this rule.
4. Set the Incident Category to associate with incidents generated by this rule.
5. Set the number of seconds for the Time Window that this rule should apply to.

In the example of excessive outgoing traffic over a five minute period, this would be set to 300.

6. Under the Conditions, click the Edit icon for Filter_1.

You will see that all your filter conditions for the search have been populated into this sub pattern.

7. You can now edit the Filter and Aggregate conditions for your original search, or change the Group By conditions.
8. Click Save when you’re done editing the rule.

This screenshot show editing the rule sub pattern Filter_1 from the original rule conditions, with the Aggregate Conditions for COUNT(Matched Events) and SUM(Total Bytes) to 1000 and 5242880 to match the new alert conditions from the example historical search, and the AND operato r changed to OR.

 

Converting an Historical Search to a Real Time Search

In the course of running an historical search, you may produce results that you want to examine in real time. For example, suppose that an historical search shows that yesterday there was an excessive amount of outgoing traffic from your home country or countries that you do business with. You may want to know if this same traffic pattern is happening right now, in real time. You can answer this question from within the same historical search that raised your suspicions.

1. In the historical search window, click Real Time Search.

The historical search criteria are loaded into a Real Time Search window and begin to execute.

2. You can now refine your Real Time Search results to reflect your current interest, for example by adding a Destination County attribute to the display results and running the search again.

Overview of Historical Search Results and Charts

When your search runs, you will see both a Results List in the bottom pane of the screen, and a chart in the middle pane. The types of charts that are displayed depend both on the data being analyzed, and whether or not you have specified any Group By conditions in your search. You can also add dimensions to your search results and change the chart display type for further analysis.

Non-Aggregated Search Results

Trend

Results List

Aggregated Search Results

Results List

Trend

Pie Chart

Bar Chart

Scatter Plot

Bubble Plot

Tree Map

Heat Map

Non-Aggregated Search Results

Non-aggregated searches are searches that don’t use any Group By conditions to process the results. These types of searches produce two views of the results:

View	Description	Screen Example	Notes
Trend	Shows the trend over time for search results
Results List	Shows the results of the search based on the Search Display fields you selected

Aggregated Search Results

Aggregated searches are those that use a Group By condition to process the results.

View	Description	Screen Example	Notes
Results List	Shows the results of the search based on the Group By and Display fields you selected		This example shows the search results for Top Event Types by Count Filter Condition: Empty Group By Condition: Event Type Selected Display Fields: Event Type and COUNT(Matched Events)
Trend	Shows the time trend of aggregated fields (one at a time)		There are two trend views of results for aggregated searches, the line chart, shown here as the first chart, and the stack chart, shown as the second chart. In this example, the line chart illustrates when the events occurred. The stacked display avoids line crossings, but the values have to be read off as the height and not the absolute value. For example, the event count for PIX-302015 at 9:00 hours is 20,000-14000 = 6000.
Pie Chart	Shows the proportion for the COUNT(Matched Events) attribute		For any set of results where you are charting Count (Matched Events), click the Pie Chart icon to view a proportional representation of the results.

 

Bar Chart	Shows the distribution of aggregated fields		For any set of results where you are charting Count (Matched Events), click the Bar Chart icon to view the distribution of events for your results.
Scatter Plot	Shows the correlation between two aggregated fields		Scatter plots can show the correlation between two aggregated dimensions, effectively converting a one dimensional chart into a two dimensional one. In this case, a report is run with these parameters: Filter Condition: Event Types PH_DEV_MON_SYS_CPU_UTIL and PH_D EV_MON_SYS_MEM_UTIL Group By attribut: Host Name Display Fields: AVG(CPU Utilization) and AVG(Memory Utilization) The results are first presented as a stacked trend and bar chart. When you click on the Scatter Plot Chart icon, you can now see the display fields as two dimensions, which shows that most devices use more memory than CPU. Hovering your mouse cursor over an item in the chart displays the values for the selected host.
Bubble Plot	Shows the correlation between two aggregated fields with a third dimension as size		A bubble pot is a scatter plot with a third dimension field added to indicate size. In this example, the same type of search that was used to generate the scatter plot example is run, though the display field Last (System Uptime) ha s been added as a Size indicator.
Tree Map	A hierarchical tree-structured visualization that can be used to analyze dominating components of multidimensional data		A tree map is a hierarchical tree-structured visualization that you can use to analyze dominant components of multi-dimensional data. A classic example is an attempt to understand Top Talkers in a network. In this example, a search is run with these parameters: Filter Conditions: Group:Permit Traffic Group by attributes: Destination TCP/UDP Port, Destination IP, Source IP Display Fields: Destination TCP/UDP Port, Destination IP, Source IP, COUNT(Matched Events) The results, which run to 400 pages with approximately 10,000 entries, do not provide any information about: The proportion of the Top Destination Port The proportion of Top Source IPs for a given Destination Port The proportion of Top Destination IPs for a given Destination Port and Source IP By switching to a Tree chart, you can now see: Top ports are 161 (SNMP) and 53 (DNS) – with SNMP taking roughly 1.5 times the connections The top destinations for DNS are: 192.168.0.10 (Internal DNS) 208.67.222.222 (External DNS) The top sources going to 192.168.0.10 on the DNS port are 192.168.20.116, 192.168.65.125 The top sources going to 208.67.222.222 on DNS port are 192.168.0.10 You can now drill down on port 53 for a closer view by clicking 53.00 in the tree map, which results in the third screenshot in this example.

 

 

Heat Map

visualizes calculated measures in two dimensions using a color grade that helps users to understand intensity

A heat map visualizes two display fields using a color gradient that indicates intensity. A classic example is an attempt to understand which host is talking on which network port. In this example, a search is run with these parameters: Filter Conditions: Group:Permit Traffic Group By attributes: Destination TCP/UDP Port, Source IP Display Fields: Destination TCP/UDP Port, Source IP, COUNT(Matched Events) The first screenshot shows the results as a stacked trend chart. The second shows the results as a heat map with the Sample set to 1000. You can now hover your mouse cursor over indicators of higher intensity to view specific information. In this case 192.168.0.10, which appears as a small red bar in the lower left corner, is a heavy contributor to traffic on Port 53. In addition, vertica l lines indicate multiple hosts communicating on the same port, for example ports 22, 53, 80, 443, while horizontal lines indicate same host talking across multiple ports.

 

 

Refining the Results from Historical Search

Overview of Historical Search Results and Charts describes the charts that you can use to visualize historical search results, but there are also a variety of methods you can use to drill down into search results and refine your queries.

Charting a Specific Row from Historical Search Results

Charting Multiple Aggregation Attributes on the Same Historical Search Results Chart

Drilling Down on Search Results by Time Interval

Using Search Results to Refine Historical Searches Using Tabs to View Multiple Search Results

Charting a Specific Row from Historical Search Results

When your chart loads, the top five items are displayed as color-coded stack charts, as show in the example of this screenshot. However, you may want to remove results from the chart to get a clearer view of what is happening with a specific result. Here, for example, there are spikes for 192.168.19.65 that are clearly visible at various intervals, but the chart results for the other IPs obscure much of what is happening with this source IP.

The solution is to remove the other Source IPs from the chart. In the Chart column of the Results List, click on the items you want to remove from or add to the chart. In this example, all four of the other IPs have been removed from the chart to obtain a clearer visualization of the activity for 192.168.19.65.

 

 

 

 

Charting Multiple Aggregation Attributes on the Same Historical Search Results Chart

When you run a query, the resulting chart typically displays the first aggregated attribute in the Results List. However, if there are other aggregated attribute values in the search results, you can add those to the chart as a second dimension.

This screenshot shows the results for the report Top Router Network Intf By Util, Error, Discards, which includes the values for a single aggregated attribute, AVG(In Intf Util), for incoming interface utilization.

In this case, it could also be informative to understand more about the outbound interface utilization. In the second Chart For menu, AVG(Out Intf Util) is selected, and this is added as a second dimension to the chart beneath the 0 line, as shown in this screenshot.

 

Drilling Down on Search Results by Time Interval

When you run a search, the chart displays results for the time interval you set in your original query. However, you can also drill down to 5 minute, 10 second, and 1 second time intervals for a closer inspection of the results.

1. Hover your mouse cursor over the result and time interval you want to drill down on until the information pop-up appears, as shown in the first example screenshot.
2. Click to drill down and view the results for a 5 minute interval.
3. Follow the same process to drill down to the 10 second and one second intervals.

This series of screenshots illustrates starting from the original search results, and then drilling down to the 5 minute interval.

 

 

 

 

 

 

 

Using Search Results to Refine Historical Searches

In this screenshot of search results you can see a small but sudden spike in the SUM(Total Bytes) for Destination TCP/UDP Port 20756, which is represented by the color purple in the chart. In order to understand what is happening in this time interval, you can select this port and the time period of interest, and use these as filter criteria for a deeper investigation.

 

1. In the Results List, select the row containing the item of interest.
2. Click the Filter menu, and you will see the attributes of the selected item as filter options.
3. Select the attribute you want to use for your filter.

In this case, you would select Destination TCP/UDP Port = 20756.

Adding a Specific Attribute Value to a Filter

You can also click in the cell of the Results List that contains the attribute value you want to use in your filter, and then select Add to Filter from the pop-up menu that appears when you hover your mouse cursor over the attribute value.

4. In the Show menu select Raw Messages.

This will include the raw event logs in the Incident Details.

5. In the Display Fields menu, add or remove any display fields you want for the refined search results.

In this case two fields are added, Destination TCP/UDP Port and Total Bytes.

6. In the chart, click on the time period that is of interest to add it to the search criteria.
7. Click Run.

This screenshot shows the results for the selected port and time period, indicating that two events originating from Seattle WA were responsible for the spike.

 

8. Click in the Raw Event Log column for an event to view the event details.

See Selecting Attributes for Structured Searches, Display Fields, and Rules for more information on how to view the attributes for reported events and add them to the display fields for your results.

Using Tabs to View Multiple Search Results

There may be occasions when you want to be able to run and compare the results of multiple searches.

1. Run your first search.
2. In the upper-left corner of the search screen, click +. A new tab will open up in the Analytics Window.
3. Run your second search in the new tab.

New Tabs for Drill-Down and Refined Searches

If you refine an existing search, zoom in on a time period, or use the time interval drill-down to examine search results, new tabs are automatically generated for each level of drill down, and for each refined search.  When you select an attribute to use in a refined search, you can also select Add to Filter in New Tab from the Options menu.