Log Search¶

Log Search gives you direct access to the network log data ingested by Investigator. When a detection fires or an entity workflow surfaces suspicious activity, Log Search is where you pivot to examine the raw evidence. Use it to investigate specific events, hunt for threats, analyze traffic patterns, or verify the details behind an alert. You can write queries using LogScale Query Language (LQL), search using natural language, stream results in real time, build visualizations, and save queries for reuse.

Whether you are an experienced analyst writing targeted LQL queries or new to log analysis using natural language, Log Search supports your investigation at every step.

Click Log Search in the left navigation to get started.

_images/log-search-nav.png — Log Search selected in the left navigation menu.¶

The Log Search page has the following key areas:

Query editor: write and run LQL queries directly.
Toolbar: access saved searches, select a display mode, set the time range and timezone, toggle Live mode, and run your query.
Fields panel: browse and filter available fields from the latest events. Click a field name to add it to your query.
Results area: view query results as an event list, table, or other visualization.
Histogram: shows event distribution over the selected time range.
NLQ input: if enabled for your organization, an input bar appears at the top of the page for searching in plain English. See Search with natural language below.

_images/log-search-overview.png — The Log Search page showing the query editor, Fields panel, results histogram, and Event List.¶

Search with natural language¶

If the Natural Language Query (NLQ) feature is enabled for your organization, an input bar appears at the top of the Log Search page. You can type a question in plain English and Investigator translates it into an LQL query automatically. Starter prompt cards below the input bar offer suggested questions to get started. For full details on using NLQ, see Natural Language Query.

_images/log-search-nlq.png — Log Search with the NLQ input bar and starter prompts.¶

Run a query¶

Enter an LQL query in the query editor. For example, use top(path) to display the top entries for the different log types.
Set the time range (see Set the time range below).
Click Run or press Enter to execute the query.
Results appear in the results area below. The histogram shows event distribution over the selected time range.

Stream results with Live mode¶

The Live button in the toolbar streams new events to the results area in real time as they are ingested. Live mode is only available when using a relative time range. If you have selected a fixed time range, Live mode is not available.

Set the time range¶

Click the date range in the toolbar to open the Time interval panel. The panel controls which time window your query searches over. You can set the time range before or after running a query.

_images/log-search-time-interval.png — The Time interval panel with Fixed time range calendars.¶

The panel offers three ways to set the time range:

Presets: common intervals such as the last 15 minutes, 1 hour, 24 hours, 7 days, or 30 days.
Relative time range: a sliding window that stays current, such as last 2 hours. Useful when you want results to update as new events arrive.
Fixed time range: a specific start and end date and time. Use the calendars and time fields to select an exact window.

Use the timezone selector in the toolbar to change the timezone used for displaying timestamps. The Time field dropdown at the bottom of the panel lets you choose which timestamp field the query uses (the default is @timestamp).

Select a display mode¶

Use the Auto (Event List) dropdown in the toolbar to select how results appear. Common display modes include:

Event List: individual log events with all fields.
Table: sortable columns for the fields returned by your query.

Additional visualization modes are available, including time charts, bar charts, pie charts, and more. Some modes require an aggregation query (for example, count() by #path) and appear as Incompatible until you run a compatible query. The Auto setting automatically selects the best display for your query.

_images/log-search-display-modes.png — Display mode options in the toolbar dropdown.¶

_images/log-search-table-view.png — Log Search in Table display mode.¶

Click Save to save the current query and visualization as a saved search, dashboard widget, or other format.

Save and reuse searches¶

Click Searches in the toolbar to access your search history and saved queries. The panel has three tabs:

My recents: recently executed queries, organized by date.
Saved searches: queries saved by you or included with the Corelight package. Use the search box and Group by selector to find specific saved searches.
Favorites: queries you have favorited. To favorite a query, run a search, click Save, and then favorite it.

To save a search, run a query, then click Save in the toolbar and choose a name. Saved searches appear on the Saved searches tab and can be shared across your organization.

Explore available fields¶

The Fields panel on the left side of the page shows available fields from the latest events. Use it to discover what fields exist across different log types and to quickly narrow your results without editing the query manually. Each field displays the number of events it appears in and its coverage percentage.

Use the Filter fields search box to find specific fields.
Click Fetch more to load additional field samples.
Click a field name to add it as a filter or column in your query.

Query language reference¶

Investigator uses Falcon LogScale (based on Humio technology) for log search. For a complete LQL reference, see the Language syntax documentation. A link to this reference is also available at the bottom of the query editor.