error code: 400

Authorization failed with error code: 400

Yes

There is an exact match for the search string in the log line.

error code: 400

Aborted operation returned error code: 4009217

Yes

Although extra characters follow the search term, there is an exact substring match.

error code: 400

HTTP request failure error code: 400

No

The character following the colon is a tab character ( 0x09) and not a space ( 0x20) in the raw log line, and therefore does not match the search expression.

error code: 400

HTTP request failure error code: 400

No

There are two spaces, instead of a single space, following the colon in the raw log line, so there is not an exact match to the search expression.

error code: 400

Device code error: 400

No

All words are present in the log line, but the order of the words do not match the search expression.

jsmith AND (failed login)

ERROR:: failed login for user: jsmith

Yes

The search expression matches logs that contain jsmith and the exact phrase failed login, including whitespace.

jsmith AND (fail OR denied)

ERROR:: failed login for user: jsmith

Yes

The first search term and only one of the OR terms appear in the search results.

jsmith AND (fail OR denied)

Permission denied to jsmith attempting deletion of object 0x943150897

Yes

The first search term and one of the OR terms appear in the search results.

jsmith AND (fail OR denied)

Login denied: user 'ajsmith' failed verification question

Yes

All the search terms appear in the log line.

HTTP (404)

HTTP (404) POST /widgets/missing

No

The syntax is invalid because the parentheses function as operators in this search expression. This syntax returns an error similar to Query contains syntax error(s): 'HTTP (404)' at position: 6.

HTTP \(404\)

HTTP (404) POST /widgets/missing

Yes

The search string appears in the log line.

"failed login"

ERROR:: "failed login"

Yes

The search expression only matches logs that contain the exact terms, including whitespace and quotes.