Advanced search allows users to run constructed queries either using Structured Query Language (SQL) or Event Query Language (EQL). In addition to both of these methods, advanced search also supports full text searching like looking for Words, Exact Phrases, and combination of words using operators. Users can use the same combination of operators that are supported in Index Search to achieve the same results in advanced search. 

To look for a specific word or a phrase, use the the following syntax: "phrase". The word or the phrase must be inside double quotes for it to work. If users do not include the quotes around the words/phrase then the following error will be seen:

Error: Syntax In EQL query, FILTER clause, parsing error at or near 'word' at this point in the query: "phrase !!!"

Examples:

• To look for the word or a combination of words like Protection Service or HTML Error, you can simply use the syntax:
  "Protection Service", "HTML Error". 
• Use of OR operator is supported: "Protection Service" OR "HTML Error"
• Use of AND operator is supported: "Protection Service" AND "HTML Error"
• Use of NOT operator is supported: "Protection Service" NOT "HTML Error"
• Using a delimiter such as parentheses to specify what gets evaluated first is also supported: ("Protection Service" AND "HTML Error") AND NOT "10.114.24.224"
• Use of wildcards such as * is also supported: "Prot*"

Note: Advanced search supports all the same index search-related capabilities (and has the *some* of the same limitations) as the traditional index search. For a complete list of operators refer to the UserGuide.pdf at docs.tibco.com

This article provides information on how advanced search supports the use of Operators such as AND, OR, NOT, etc. and it also provides information on how to perform searches for looking up a particular word or a phrase without using the EQL / SQL syntax.

Users must be running 6.1.x and higher LMI version with LSP 32.1 and higher. Advanced features must be enabled.