Using query expressions for log search

Using an advanced search capability, you can combine multiple search terms with different operators to run a more specific search. A query expression can either consist of multiple search terms that are separated by commas or multiple search terms that are grouped with parentheses.

Supported query expressions

The list of different query expressions that you can run:

Query Expression = search_term1, search_term2: A query that has search terms that are separated by a comma returns log entries that contain the specified values in the same row. For example, the query, Project, Delete, retrieves log entries that contain both Project and Delete in the same row.
Query Expression = (search_term1) OR (search_term2): Multiple queries with search terms joined by the OR operator and grouped in parentheses return log entries that contain either one or both search terms within the same row. For example, the query (Project, Delete) OR (Untitled Workflow), searches for log lines that contain either Project and Delete or Untitled Workflow or both in the same row.
Query Expression = (field1:search_term1, field2:search_term2): A query with field-based searches returns the log entries where the attribute equals the specified value in the same row. For example, the query (module: project, action: create), searches for log lines where the module - project equals action - create in the same row.

Supported operators

A query expression allows the listed operators:

OR: Example - (Project, Delete) OR (Default).; Searches for log entries that contain either or both of the specified search terms in the same row.
, (comma): Example - Project, Delete; Searches for log entries that contain all the specified search terms in the same row.
: (colon): Example - (module: project, action: delete); Searches for log entries where the field equals the specified value.

Example queries

The section lists a few examples of query expressions for searching a specific set of log entries:

workflow, delete: Retrieve log entries that contain workflow and delete in the same row.
created, johndoe: Retrieve log entries for which the 'Created' action that 'johndoe' run.
(created, johndoe) OR (updated, johndoe): Retrieve log entries for which the 'Created' or 'Updated' action that 'johndoe' run.
(published, janesmith) OR (published, johndoe) OR (published, veronicasmith): Retrieve log entries for projects that 'janesmith', 'johndoe', or 'veronicasmith' publishes.
(module: project, action: delete): Retrieve log entries where the column fields include - 'module' and 'action' equal values - 'project' and 'delete'.