Introduction
This article will provide advanced search examples using all techniques and capabilities of the Lucene language in the search section.
Type each query into the query bar on the Search page and click Search. The date range above the query bar limits the results in addition to the query. To see the values that the query matches, click Result Fields. In the Search Column Settings window, add the related fields with Add and click Apply. If you click Cancel, the window does not add the fields.
Advanced Search with Lucene
The screenshot below shows an example search using the criteria: "source IP address must be in the 10.10.100.0/24 or 192.168.250.0/24 subnet group, target port must be 443, protocol must not be TCP, and the search date range must not include times between 00:00 and 08:59 on the relevant day."
A query that matches these criteria:
(Source.IP:"10.10.100.0/24" OR Source.IP:"192.168.250.0/24") AND Destination.Port:443 AND NOT Protocol.Name:TCP AND NOT Time.Generated:[now/d TO now/d+9h}Put a subnet in CIDR notation inside double quotes. There is no separate hour field, so the time exclusion is written as a Time.Generated range. The example above excludes 00:00 to 08:59 of the current day only. Replace the subnets with subnets from your own network.
In the screenshot below, filtering has been applied to data that includes columns for source MAC address and source IP address, and includes only users with the name Administrator or whose username does not end with the "$" symbol.
A query that matches these criteria:
_exists_:Source.MAC AND _exists_:Source.IP AND (Source.UserName:Administrator OR (*:* AND NOT Source.UserName:*$))_exists_:<field> returns only events where that field has a value. Inside an OR group, write the negative part as (*:* AND NOT ...). If you write Source.UserName:Administrator OR NOT Source.UserName:*$, Lucene returns only the Administrator matches.