Using the Search interface
Using the Search interface
This section provides an overview on how to use the Search interface. It describes how you can access the Search interface, lists the steps to take to search effectively, view the details of a connection, replay the audit trails, or export the search results as a comma-separated text file.
Prerequisites
Users need the Search privilege to access the Search interface.
NOTE: Assigning the Search privilege to a user on the Users & Access Control > Appliance Access page, automatically enables the Search in all connections privilege, and grants the user access to every audit trail, even if the user is not a member of the groups listed in the Access Control option of the particular connection policy.
If you want users to access audit trails only for connections for which they are granted permission, see Assigning search privileges.
For information on configuring:
-
To access the Search interface, navigate to Search.
Sessions are displayed sorted by date. For ongoing sessions, the Search interface is updated in real-time to always show the most up-to-date information.
You can view sessions in a card, table or flow view. Click 
for more details and select from the list.
-
Specify a date and time range to restrict your search criteria as described in Specifying time ranges.
-
Filter connections as described in Using search queries.
-
Search the contents of audit trails as described in Searching in the contents of audit trails.
-
View connection details as described in Viewing session details.
-
Download and replay audit trails as described in Replaying audit trails in your browser.
-
To export the search results as a comma-separated text file, click for more details and select Export CSV. Note that if your search returns more than 10.000 results, only the first 10.000 rows are exported. If you want to see all results, refine your search.
To customize which fields are exported, click for more details and select Export CSV ....
Card view
You can view sessions in a card, table or flow view. Click for more details and select from the list.
In card view, you can add additional search fields to the Search interface. For more information, see Adding custom fields to the card view.
Figure 262: Search — Card view
Adding custom fields to the card view
In card view, you can add additional search fields to the Search interface. This allows quick visualization of your preferred fields from the main page of the Search interface for each session.
Adding custom fields to the card view
-
Click for more details and select Customize Card Fields from the list.
Figure 263: Search — Customize Card Fields
-
Select fields from Collapsed top and Collapsed bottom and the fields will be added as separate fields to the collapsed view of each session.
The fields you select from Expanded top and Expanded bottom will be added to the expanded view of each session as shown in the figure below.
Figure 264: Search — Preview
NOTE: Some fields may not be available for every session. When the field is not available, for example, if you have data recorded by SPP, the field will be empty.
Table view
You can view sessions in a card, table or flow view. Click for more details and select from the list.
Figure 265: Search — Table view
