Navigate between the different views in the application you are in. For the Search & Reporting app the views are: Search, Datasets, Reports, Alerts, Dashboards, and Modules.

Specify whether to search using SPL or SPL2.

The setting in the language picker cannot be changed directly after you run your search, or if you open the search by selecting Open in search from a report. In these scenarios, you can only change the language from SPL to SPL2 by selecting Convert to SPL2. If you want to change the language from SPL2 to SPL, you must select Close and start over with a new search.

Convert a search from SPL to SPL2.

This button is available only when the language picker is set to SPL and the Search bar contains a search.

Specify your search criteria.

Specify the time period for the search, such as the last 30 minutes or yesterday. The default is Last 24 hours.

Run the search specified in the Search bar.

Use the search mode menu to provide a search experience that fits your needs. The modes are Smart (default), Fast, and Verbose.

Review a list of the searches that you have run.

The search history appears after you run your first search, and only shows previous searches for the selected language. For example, if the language picker is set to SPL2, then the search history shows previous SPL2 searches but not previous SPL searches.

Use the links to learn more about how to start searching your data using SPL, as well as get a summary of the data that you have access to.

Use the links to learn more about how to start searching your data using SPL2, and to open the SPL2 module editor in a new browser tab.

Use the Save As menu to save your search results as a report, dashboard, alert, or event type.

SPL2 search results cannot be saved as event types.

Actions that you can perform include working with your search job, and sharing, printing, and exporting your search results.

The tab that your search results appear on depends on your search. Some searches produce a set of events, which appear on the Events tab. Other searches transform the data in events to produce search results, which appear on the Statistics tab.

A visual representation of the number of events that occur at each point in time. Peaks or valleys in the timeline can indicate spikes in activity or server downtime. The timeline options are located above the timeline. You can format the timescale, or zoom in or out of a selected set of events.

Displays a list of the fields discovered in the events. The fields are grouped into Selected Fields and Interesting Fields.

Displays the events that match your search. By default, the most recent event is listed first. In each event, the matching search terms are highlighted. To change the event view, use the List, Format, and Per Page options.