Make searches easier to read

Long searches can be difficult to read. For example, the following search uses multiple commands and includes many occurrences of renaming columns in the search results.

sourcetype=access_* status=200 | stats count AS views count(eval(action="addtocart")) AS addtocart count(eval(action="purchase")) AS purchases by productName | eval viewsToPurchases=(purchases/views)*100 | eval cartToPurchases=(purchases/addtocart)*100 | table productName views addtocart purchases viewsToPurchases cartToPurchases | rename productName AS "Product Name", views AS "Views", addtocart as "Adds To Cart", purchases AS "Purchases"

The following image shows how this search appears in the Search bar.

You can use a keyboard shortcut to parse each pipe section on a separate line. Any subsearches are indented. The auto-format feature does not need to be turned on to use these keyboard shortcuts.

• On Linux or Windows use Ctrl + \
• On Mac OSX use Command + \
• You can also use Ctrl + Shift + F or Command + Shift + F, which works well with many non-English keyboards.

You can also use Shift + Enter to force a new line. See Line and word shortcuts.

Expand your search

For long searches, or searches that contain search macros or saved searches, it can be difficult to see the entire search in the Search bar.

You can see the contents of your entire search by using a keyboard shortcut, Command+Shift+E (Mac OSX) or Control+Shift+E (Linux or Windows) from the Search bar in the Search page. This opens a preview that displays the expanded search string, including all search macros and saved searches. If syntax highlighting or line numbering are turned on, those features also appear in the preview.

You can copy parts of the search from the preview window. You can also click Open in Search in the preview window to run your search in a new window. See Preview your search.

Highlight search terms

To highlight all of the occurrences of a word in the search, double-click on that word.

Locate matching parenthesis

Position your cursor immediately after an open or close parenthesis. The matching parenthesis is highlighted.

Add and remove comments shortcuts

You can use the following keyboard shortcuts to add or remove comment characters in a search.

• On Linux or Windows use Ctrl + /
• On Mac OSX use Command + /

For more information about adding comments and using comments to troubleshoot searches, see Add comments to searches.

Undo and Redo shortcuts

Use these keyboard shortcuts to undo and redo actions in the Search bar.

Search history shortcuts

Use these keyboard shortcuts to scroll through your search history.

Search assistant window shortcuts

With the Compact mode of the search assistant, you can use keyboard shortcuts to select items in the list and close and reopen the search assistant window.

Find and replace shortcuts

Use the following keyboard shortcuts to find and replace terms in the Search bar.

Line and word shortcuts

The distinction between rows and lines is important to understand when you use keyboard shortcuts to manipulate rows or lines in your search criteria in the Search bar.

• Long searches appear on multiple rows in the Search bar.
• If the search is not parsed, the search is one line.
• If the search is parsed, separating each piped section and subsearch into its own line, a row is the same as a line.