This article explains how to perform an advanced search by using AND / OR operators on the Log Activity tab.

Use the Advanced Search feature to build an Ariel Query Language (AQL) search query to retrieve specific information about events and flows.

For example, to search for values that would fall in the same column, such as an event name, administrators should create a search that leverages the OR value.

Tip: If you are searching for values with a space in them, such as an event description or a custom property, include single quotation marks around your value.

For example:

select * from events where QIDDESCRIPTION(qid) = 'Create or update server administrator ' OR 'VM administrator login';

Tip: When searching data that falls in the same column of the user interface or appears only once in the event payload, use OR operators in the search.  In the following example, we are trying to find out how many events contain the QID of 94000001  OR  38750003.

Incorrect

SELECT * from events where QID = 38750003 AND QID = 94000001;

 

Correct

SELECT * from events where QID = 38750003 OR QID = 94000001;

2019-08-27: content reviewed for accuracy.  minor format changes.