Search expression syntax

A raw log search can be as simple as entering a single word or as complex as a Boolean expression with multiple operators.

Tip:

Not entering a search term returns all logs in a specified time range.

A complex search expression uses conditional logic to limit the number of matches. This logic is expressed as a combination of search terms and one or more operators using this general syntax:

BASH 
<search_term><space><operator><space><search_term>

Where:

  • search_term is a string value. For example, a word or number sequence. It can include whitespaces, quotation marks, or special characters.
  • space is the 0x20 character.
  • operator is the AND, OR, or NOT Boolean operator.

Parentheses, (), are also operators. Parentheses allow you to group Boolean expressions and specify the order of operations.

For more information about writing search expressions, see:

Tip:
  • To write a complex search expression, you can use a query template that is similar to the search you want to run, and then modify the search expression. For more information, see Run a search.
  • If you are unsure about how to structure a complex search expression, you can start with a broad search, and then review the results to decide how best to refine your expression.

Exact string matching

Recherche de journaux bruts uses exact string matching. This means that if a search term includes whitespaces, quotation marks, or special characters, Recherche de journaux bruts considers those characters to be part of the same string.

Note:
  • Wildcard characters are not supported.
  • Raw logs are not parsed. Therefore, Raw Log Search cannot determine if a string match in log data represents a field name or field value and will return all matches.

Search expressions use exact matching, so you can modify a search term to make your search broad or narrow. For example, if you want to find Cisco ASA logs with message ID 201009, the search expression 201009 results in a search that is too broad. Logs that match this search expression would include all logs that contain the substring 201009, even if 201009 is not part of a message ID. For example:

  • MSWinEventLog ... "EventID":4625 ... "RecordNumber":201009 ...
  • MSWinEventLog 1 Microsoft-Windows-GroupPolicy/Operational 1201009 ...
  • "@type":"awn-agent" ... "systemTime\":\"2024-02-05T23:03:50.2010099Z\" ...

A more refined search expression is %ASA-201009.

Operators

Recherche de journaux bruts supports various search operators.

Note:
  • You must include a single space character on both sides of the AND, OR, and NOT operators, and you must write these operators in all capital letters.
  • A search expression can have up to 10 operators.

Operator

Description

AND

Separates individual search terms, requiring that both are present in any order in the log line.

OR

Separates individual search terms, and returns results where either term is present anywhere in the log line.

NOT

Excludes searches from the results that contain the term following NOT in the search expression.

( )

Controls the order of operations when you use multiple operators in your search expression. Without parentheses, the default precedence is NOT, AND, then OR. To search for parentheses contained within log data, you must use the backslash \ character to escape the parentheses operation in your search expression.

For example, NOT aa OR bb AND cc is a valid search expression to find records that do not contain aa, or contain both bb and cc in any order. NOT aa OR bb AND cc is equivalent to (NOT aa) OR (bb AND cc) and would match these log lines:

  • logID 0001: bb cc ii
  • logID 0027: aa bb cc
  • logID 0378: zz yy hh
  • logID 0690: bb hh vv
  • logID 1822: gg ii cc

Case sensitivity

Search expressions are case-sensitive by default. You can deselect the Case sensitive option to ignore capitalization.

Character limits

  • A search expression must contain at least 2 non-whitespace characters. Search expressions with only one non-whitespace character, for example a or b, are invalid.
  • A search expression must not contain more than 1000 characters including whitespace characters. Search expressions that exceed this length are invalid. UTF-8 characters, for example, a mathematical symbol, might count as multiple characters.

Wildcards

Wildcard characters, for example * or ?, are not supported. All search expressions are substring matched, so the * wildcard character is implied on both sides of the search word. For example, entering error is equivalent to entering *error*.

Reserved characters

Reserved characters are characters that you cannot use in search expressions. Search expressions that contain any of these characters are invalid:

  • The line feed or new line character, 0x0A, often represented as \n.
  • The carriage return character, 0x0D, often represented as \r.
  • The vertical tab character, 0x0B, often represented as \v.
  • The form feed character, 0x0C, often represented as \f.
  • The shift out and shift in characters, 0x0E and 0x0F.
Note:

Reserved characters are typically non-printable characters in the low-ASCII range, 0x00 to 0x1F, or the high UTF-8 range.