Search window toolbar

Apply time intervals previously set in any active queries. Learn more about this in this article.

Hide or show fields in the data table to work only with the necessary ones. Check out Hide and show fields to learn how to do it.

This is useful to see and be able to download information for a few selected events instead of the whole table.

First, select the rows you want to see or download, by clicking on their rows. Then click the clipboard icon. This allows you to check information about specific events in the data table. Select one or several events in the data table to make this option available. Learn more in Data table.

Access a set of operations to edit and arrange the table fields. Learn more about these operations in the articles in Modifying the field layout.

Open a query editor where you can build or modify the current query using the LINQ syntax. Learn more in Query code editor.

Display a treemap representing all the operations applied to the original data table. Learn more in Applied query operations.

Use this tool to analyze and decode your data before building your query. Learn more in Manipulate your data using CyberChef.

Define alerts to monitor active queries and receive notifications when certain conditions occur. Check the instructions in Creating new alerts.

Perform aggregation operations on table data that has been already grouped by time interval.

Group data to get all the different row value combinations of the grouped fields.

You can use an OR filter to get records that have any of the values for a given property.

Filter data to retrieve certain values or exclude them from the table.

Create fields in your data tables transforming the already existing data.

Download query data in different formats. Go to Download query data for further information.

Check this box to activate server mode in your searches. The default search mode is recommended for small queries, while server mode is recommended for queries that process a large amount of data. Learn more in Best practices for data search. You can set server mode as default in your User preferences.

Close the current search.

You can open a new search without going back to the finders area. Clicking this button will open a floating window where you can specify the details of the new search:

• Query → insert the desired query (you can make use of the smart query editor features). The query will be continuously checked for validation while you write, activating the run button only when a valid query is specified.

• Select all fields → choose whether you want to show all fields or only those specifically invoked in the query (see this article for help).

• Time range → the same time range used for the open search is replicated here, but you can change it if you want (see this article for help).

Click Run search when you finish. The new search will open in the same browser tab while keeping the other search open.

Open

Access a set of additional operations that do not appear in the default toolbar.