Indexing event data…
failed | events whose raw text contains failed (case-insensitive) |
"failed logon" | exact phrase (spaces allowed) |
src_ip=10.20.30.44 | field equals value (whole-value match) |
src_ip=10.20.* | wildcard — * matches anything |
user!=admin | field exists and does not equal value |
a b | implicit AND — both must match |
a OR b, NOT a | boolean operators (any case); AND binds tighter than OR |
(a OR b) NOT c | parentheses group |
index=fw | limit to one log source; also sourcetype="pan:traffic" |
No pipe commands here — use the Fields sidebar for top values. Click any field value in an expanded event to filter on it.
Keys: / focus search · Enter run · Esc close