Asset-based searches

Prev Next

Index Search in the Helix Enterprise Web UI has keys such as assets and asset_type that allow you to build a search query. You can hover over or click the assets field in Search Results to view nested fields such as asset_id, asset_name and asset_uuid and then use the values that are returned in subsequent searches.

For example, the following query finds events with the "username" field and correlates users to physical devices.

assets.event_fields:username | groupby hostname

For complete information about search queries and more examples of asset-based search queries, see the TQL Reference Guide.