[LR] Web Console Display Name - Lucene Syntax Cheat Sheet (DRAFT) by DonPromillo

To escape a special character that is part of the query syntax, use a backslash before the character. Characters that require this treatment are: + - && || ! ( ) { } [ ] ^ " ~ * ? : \

If you wanted to run a query for all impacted users whose account ends with Smith, you would use: logi­n:/.*S­mith/

If you wanted to run a query for all activity that falls under the Malware or Attack classi­fic­ations, you would use: classi­fic­ati­onN­ame­:("M­alw­are­" "­Att­ack­")

If you wanted to run a query for the host from which a log activity origin­ated, EXCLUSIVE of the first and last IP address, you would use: orig­inHost: {106.1­94.1­90.210 TO 106.19­4.1­90.2­50}