Simple Search Syntax Quick Reference Guide

Use the following table as a quick reference for using the Simple Search query syntax:

Syntax rule Valid Query Format Example
Exact Match entire field Field:"term"

data_source: "rhel_linux"

data_source: *azure
Field missing -field:* -data_source: "rhel_linux"
Field exists field:* data_source: *
Ranges
1 to 5, including 1 and 5

[1 to 5]

[1 TO 5]

 duration: [0 TO 4]
1 to 5, excluding 1 and 5

{1 to 5}

{1 TO 5}

 duration: {1 TO 4}
1 to 5, including 1, excluding 5

[1 to 5}

[1 TO 5}

 duration: [0 TO 4}
Larger than >

duration:>0

event_time:>"2025-02-28T20:02:59Z"
Smaller than <

duration:<1

event_time:<"2025-02-28T20:02:59Z"
Larger or equal to >=

duration:>=0

event_time:>="2025-02-28T20:02:59Z"
Smaller or equal to <=

duration:=<1

event_time:<="2025-02-28T20:02:59Z"
IP CIDR notation "10.0.0.0/8"  
Boolean Operations
Must be present

+

 

 event_time:>="2025-02-28T20:02:59Z"+src_ip4:"66.222.222.222"
And ANDand&&

event_time:>="2025-02-28T20:02:59Z" && src_ip4:"66.222.222.222"

event_time:>="2025-02-28T20:02:59Z" AND src_ip4:"66.222.222.222"
or ORor||

event_time:>="2025-02-28T20:02:59Z" || src_ip4:"66.222.222.222"

event_time:>="2025-02-28T20:02:59Z" OR src_ip4:"66.222.222.222"
Not NOTnot| event_time:>="2025-02-28T20:02:59Z" AND NOT src_ip4:"66.222.222.222"
Wildcard *

event_time:>="2025-02-28T20:02:59Z" AND NOT src_ip4:"66.2*"

 
Field contains A or B field1:(term1 OR term2) dst_port:(3389 OR 445 OR 22)
Field contains A and B field1:(term 1 AND term2) data_source:tipping_point_ips AND rule_name:"19698: bittorrent: udptracker connect request" AND src_ip4:"151.193.0.0/16"
Grouping

Basics (term operator term) operator term

Boolean logic combined with brackets

(term1 OR term2) AND term3

Must contain either or both term1/term2 and term3

   data_source:windows_security_events AND event_id:4625 AND (user_name:administrator OR user_name:admin)
Regular expressions

Regular expression patterns can be embedded in the query string by wrapping them in forward-slash ("/")

It cannot be used with non-string types

 

Field:/joh?n(ath[oa]n)/

 data_source:/.*azure$/
Wildcards
Multiple characters * data_source:"*azure"

Querying by timestamp with the Simple Search query syntax

You can use the Simple Search syntax to query by timestamp using one of the following two methods:

  • Using an ISO 8601 combined date/time representation, including time zone offset, as per the following examples:

    • 2023-04-05T08:54:00Z

    • 2021-04-11T09:00:00-04:00

    • e.g. event_time: "2025-02-28T14:30:15Z" or event_time: "2025-02-28T14:30:15+05:00"

  • Relative to “now”, where “now” is the time at which the query is run. This is specified by writing now, then a negative number, then a time unit specifier. Time unit specifiers can be s for seconds, m for minutes, h for hours, or d for days. Examples:

    • now-90s - 90 seconds ago

    • now-15m - 15 minutes ago

    • now-3h - 3 hours ago

    • now-7d - 7 days ago

When specifying X days, interprets this as precisely X days (24*X hours) prior to the current time, and not rounded to the start or end of the day.

Specify time search terms using the following formats:

  • As ranges with two bounds, using bracketed range notation like [lower TO upper]. Consider the following examples:

    • event_time:[2023-04-04T09:00:00Z TO 2023-04-04T09:30:00Z] - match logs with event_time between the two times shown, inclusive.

    • event_time:[2023-04-04T00:00:00-04:00 TO 2023-04-05T00:00:00-04:00} - match logs with event_time on or after midnight, April 4 to logs with event_time up to but not including midnight, April 5. That is, match all logs that happened on April 4.

    • index_time:[now-1h TO now-10m] - match logs with index_time from 1 hour ago (inclusive) up to 10 minutes ago (inclusive).

  • As a single bound using an inequality like <, <=, >, >=. When using inequalities with ISO timestamps, the time term must be enclosed in double quotes to avoid ambiguity. Consider the following examples:

    • event_time:>="2023-02-28T13:00:00Z" - matches logs with event_time on or after 13:00 UTC on February 28

    • event_time<"2023-04-11T10:15:00-04:00" - matches logs with event_time before 10:15 (UTC-4 hours) on April 11

    • event_time>now-15m - matches logs with event_time greater than 15 minutes ago
  • As an exact equality using just : or = . This is typically not very useful as the value in the log must match the value entered to the microsecond in order to match; the likelihood of a log matching to this precision without advance knowledge of the contents of the log is small. Consider the following example:

    • index_time:"2023-01-31T00:00:00.000000Z" - match logs with index_time exactly midnight UTC on January 31.

For the form with upper and lower bounds it is possible to use *for the upper or lower bound to effectively mean unbounded at that end (e.g., event_time:[2023-01-01T00:00:00Z TO *]). It is usually more convenient to use a single bound inequality instead (e.g., event_time>="2023-01-01T00:00:00Z" is the equivalent).

The Time Range selection in the UI is always applied to the event_time field. This means a query including event_time must set the drop-down to include a wide enough time range to find events with the event time of interest. For example, if Time Range is set to “Last 30 Minutes” and the query is event_time<now-1h the search will return no results because there is no overlap between “Last 30 Minutes” and “more than 1 hour ago”.