Searching Machine Events Works Poorly

%3CLINGO-SUB%20id%3D%22lingo-sub-394809%22%20slang%3D%22en-US%22%3ESearching%20Machine%20Events%20Works%20Poorly%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-394809%22%20slang%3D%22en-US%22%3E%3CP%3EWhen%20viewing%20the%20details%20of%20a%20specific%20machine%20in%20the%20Timeline%20pane%2C%20I%20find%20the%26nbsp%3B%3CEM%3ESearch%20events%3C%2FEM%3E%26nbsp%3Bfield%20works%20so%20poorly%20that%20I%20have%20no%20trust%20in%20it%20at%20all.%26nbsp%3B%20Is%20there%20a%20specific%20search%20syntax%20that%20I%20should%20be%20using%20to%20improve%20my%20search%3F%26nbsp%3B%20For%20instance%2C%20I%20wanted%20to%20see%20how%20often%20the%20%22Anomalous%20memory%20allocation%22%20Process%20event%20showed%20up%20for%20a%20machine.%26nbsp%3B%20Searching%20for%26nbsp%3B%3CSTRONG%3EAnomalous%3C%2FSTRONG%3E%20returns%20%22No%20events%20found%22.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Contributor

When viewing the details of a specific machine in the Timeline pane, I find the Search events field works so poorly that I have no trust in it at all.  Is there a specific search syntax that I should be using to improve my search?  For instance, I wanted to see how often the "Anomalous memory allocation" Process event showed up for a machine.  Searching for Anomalous returns "No events found". 

 

0 Replies