Tab characters

For logs that include tab-separated values, you can add horizontal tab characters to your search term to limit the number of matches.

In Windows event logs, event IDs are tab-separated. To search for a Windows event ID, in your search term, insert one horizontal tab character, 0x09, before and after the event ID. This prevents the search expression from matching other log data that might contain the same series of numbers, like timestamps or UUIDs.

To insert a horizontal tab character, on the search bar, click Indent.

For example, to search for all failed and successful login attempts for user jsmith, use this search expression:

BASH 
MSWinEventLog AND (   4624   OR   4625   ) AND jsmith

Where:

  • MSWinEventLog limits the search to Windows event logs.
  • jsmith is the username.
  • 4625 is the event ID for a failed login attempt.
  • 4624 is the event ID for a successful login attempt.
Note:

In this example, there is a horizontal tab character before and after each event code and a single space before and after the OR operator.

The order of search terms and whitespace characters is:

BASH 
MSWinEventLog<space>AND<space>jsmith<space>AND<space>(<tab>4624<tab><space>OR<space><tab>4625<tab>)

Where:

  • space is the 0x20 character.
  • tab is the 0x09 character.