This section provides an overview on how to use the Search interface. It describes how you can access the Search interface, lists the steps to take to search effectively, view the details of a connection, replay the audit trails, or export the search results as a comma-separated text file.
Users need the Search privilege to access the Search interface.
NOTE: Assigning the Search privilege to a user on the Users & Access Control > Appliance Access page, automatically enables the Search in all connections privilege, and grants the user access to every audit trail, even if the user is not a member of the groups listed in the Access Control option of the particular connection policy.
If you want users to access audit trails only for connections for which they are granted permission, see
For information on configuring:
To access the Search interface, navigate to Search.
Sessions are displayed sorted by date. For ongoing sessions, the Search interface is updated in real-time to always show the most up-to-date information.
Specify a date and time range to restrict your search criteria as described in Specifying time ranges.
Filter connections as described in Using search queries.
Search the contents of audit trails as described in
View connection details as described in Viewing session details.
Download and replay audit trails as described in
To export the search results as a comma-separated text file, click for more details and select Export CSV. Note that if your search returns more than 10.000 results, only the first 10.000 rows are exported. If you want to see all results, refine your search.
To customize which fields are exported, click for more details and select Export CSV ....
In card view, you can add additional search fields to the Search interface. For more information, see Adding custom fields to the card view.
Figure 241: Search — Card view
In card view, you can add additional search fields to the Search interface. This allows quick visualization of your preferred fields from the main page of the Search interface for each session.
Adding custom fields to the card view
Click for more details and select Customize Card Fields from the list.
Figure 242: Search — Customize Card Fields
Select fields from Collapsed top and Collapsed bottom and the fields will be added as separate fields to the collapsed view of each session.
The fields you select from Expanded top and Expanded bottom will be added to the expanded view of each session as shown in the figure below.
Figure 243: Search — Preview
NOTE: Some fields may not be available for every session. When the field is not available, for example, if you have data recorded by SPP, the field will be empty.
Figure 244: Search — Table view