Search log data quickly

If your SIEM solution includes a Trellix Enterprise Log Search (ELS), you can search uncompressed log data. ELS searches are faster than ELM searches.

On the dashboard, click and select ELS Search.

In the search bar, enter the text you want to find, then click . You can use standard Boolean operators in the search.

Operator/Modifier	Description	Characters	Examples
and	Returns items that contain both terms.	space and AND &	john doe john and doe john AND doe john & Doe
or	Returns items that contain either term.	or OR \|	john or doe john OR doe john \| doe
not	Excludes terms from results. Must be used with AND.	not NOT !	john and not doe john and NOT doe john and !doe john and ! doe
""	Returns items that contain a specific term. Quotation marks must be used in pairs and search terms cannot contain spaces.	"	"john"
()	Nested search terms help narrow search results. Terms contained in parentheses are processed first.	()	(john and doe) or smith (john) and (doe or smith) john (doe \| smith) (john \| jane)(doe \| smith)
*	Wild cards return terms that contain, start with, or end with a specific term.	*	abcd - contains abcd* - starts with *abcd - ends with

Note
The system ignores the following words:but, be, with, such, then, for, no, with, not, are, and, their, if, this, on, into, a, or, there, in, that, they, was, is, it, an, the, as, at, these, by, to, of.

Refine your search results.
- Click Search Settings to set the result file expiration and the number of rows returned.
- Click Search History to view and rerun previous searches.
- Click to refresh your search results.
- Click the drop-down arrow, to filter your search results by time or days.
- To narrow your search further, enter information in the search results and click .