Search Option Parameters

Case sensitive

Default: Yes

Controls whether to differentiate between upper- and lower-case characters during a search. When this option is set to No, searching for "login" will find "login," "Login," and "LOGIN".

Setting this option to No may affect query performance.

Changing the case-sensitivity only applies to the local Logger. Peer Loggers will continue to use their own settings.

Full-text search (keyword search) is case insensitive. You cannot change its case sensitivity.

Include NULL field value in NOT operator results

Default: No

Setting this option to Yes causes queries using the NOT operator to return events where the field value matches the filter criteria or is NULL.

The default, No, causes queries using the NOT operator to only return events where the field value matches the filter criteria.

Enforce Header Request

(ehr)

Default: Yes

Hides the navigation bar when processing a request from another system.

ausm_query

Query expression that will be executed.

Example values:

DeviceVendor is not null

Name=arcsight | chart count by deviceEventId

sourceAddress insubnet 15.0.0.0

Local_search

Values: True, False

Default: True

Enables a peer or local search.

Field_summary

Values: True, False

Default: True

You can also change the setting once results are retrieved by checking the Fields Summary box on the Search screen.

Discover_fields

Values: True, False

Default: False

Detects non-CEF fields in raw events automatically. You can also change the setting once results are retrieved by checking the Discover Fields box.

From

Values: Dynamic, static.

Start time of the search.

To

Values: Dynamic, static.

Example values:

$Now - 12

8/10/2020 14:02:02

End time of the search.

Search_time

Values:

event_time: When the event actually occurred.

receipt_time: When the event arrived to logger.

Sets the time type used when executing the search.

Use primary delimiters

Default: Yes

Controls whether primary delimiters are applied to an event to tokenize it for indexing.

A primary delimiter tokenizes an event for indexing. For example, an event "john doe the first" is tokenized into "john" "doe" "the" "first" using the “space” primary delimiter.

The primary delimiters are:
space, tab, newline, comma, semi-colon, ( ) [ ] { } “ | *

Use secondary delimiters

Default: No

Controls whether secondary delimiters are applied to an event to further tokenize a token created by a primary delimiter thus enabling searches that can match a part of a primary token.

For example, you can search for "microfocus.com" in https://www.microfocus.com.

The secondary delimiters are:
period, = : / \ @ - ? # & _ > <

Case sensitive

Default: No

See Case sensitive.

Unicode case sensitive

Default: No

Controls whether events in languages other than English should be compared in a case-sensitive way.

Check for canonical equality

Default: No

Controls whether events in languages other than English should be compared using locale-specific algorithms.

Populate rawEvent field for syslog events

Default: No

Controls whether raw events are displayed in a formatted column called rawEvent using the Raw Event field set. This option applies to syslog events only. If you want to view the raw events associated with CEF events, you do not need to configure this setting. Instead, configure the connector that is sending events to Logger to populate the rawEvent field with the raw event.

Show Source and SourceType fields

Default: No

Controls whether the Source and SourceType fields are included in the Field Summary and query results.

You must reboot the Logger Appliance/restart the Software Logger for this change to take effect.

Expiry time (min)

Default: 10
Range: 1–60

Controls how long a completed search remains available in Logger memory before expiring.

• This option controls both single and concurrent search expiry times.
• Clicking the Session ID opens the search results in a new tab and resets the expiry time. Using the pagination link (moving through the display pages) for a search also resets the expiry time.

Maximum concurrent searches

Default: 0 (unlimited searches)
Range: 1–1000

Controls how many concurrent searches this Logger can run, including dashboards and Saved searches.

Max hits of Search UI

Default: 1 000 000
Range: 1–10 000 000

Controls the maximum limit of hit results in Logger Search UI.

• Since Logger had a limit of 1 000 000 in previous versions, this value has been set as default.

Max hits of Search API

Default: 1 000 000
Range: 1–10 000 000

Controls the maximum limit of hit results using the API.

Since Logger had a limit of 1 000 000 in previous versions, this value has been set as default.