Skip to content

Searching & Filtering Events

The View module provides real-time and historical access to all audit log data collected by LT Auditor MP. This article covers how to search, filter, sort, paginate, and export log data within a view. For guidance on creating and configuring views see the View Dashboard article.

Accessing log data:

  1. Log in to the LT Auditor MP web portal
  2. Navigate to View in the main navigation menu
  3. Select a saved view from the list
  4. The log table displays audit records matching the view’s environment, category, and default date range

Quick filters:

Quick filters allow rapid narrowing of results directly from the view without opening the advanced filter panel:

  1. Use the filter bar at the top of the view
  2. Enter search terms in the quick search box
  3. Select filter criteria from the available dropdown menus
  4. Results update in real time as you type

Advanced filters:

For more precise filtering use the advanced filter panel:

  1. Click Advanced Filters
  2. Add one or more filter conditions:
    • Select a Field from the log schema
    • Choose an Operator:
Operator Description
Equals Exact match
Contains Partial text match
Starts With / Ends With Pattern matching
Greater Than / Less Than Numeric comparison
In / Not In Match against a list of values
Is Null / Is Not Null Check for empty values
  • Enter the comparison value
  1. Combine conditions using AND/OR logic:
    • Click Add Condition Group
    • Choose AND — all conditions must match, or OR — any condition must match

Nest condition groups for complex logic:
Example: (A OR B) AND (C OR D)

  1. Click Apply Filters

Date range filter:

  1. Use the date range picker at the top of the view
  2. Choose from:
Option Description
Quick ranges Today, Yesterday, Last 7 Days, Last 30 Days, etc.
Custom range Specific start and end dates
Relative range Dynamic ranges that update automatically (e.g., Previous Month, Current Quarter)
  1. The log table refreshes automatically when the date range changes

Always set a specific date range before searching — open-ended queries against large datasets or high-volume categories can be slow to load.

Full-text search:

Perform full-text searches across all collected log data:

  1. Enter search terms in the search box
  2. Choose the search scope:
    • All Fields — searches across every field in the log schema
    • Specific Field — searches within a single selected field
  3. Use search operators for more precise results:
Operator Usage Example
AND Both terms must appear login AND failed
OR Either term must appear login OR logon
NOT Exclude a term login NOT success
Exact phrase Match exact wording “account locked”
Wildcard Match partial terms admin*
  1. Press Enter or click Search

Sorting results:

  • Click any column header to sort by that field
  • Click again to reverse the sort direction — ascending and descending indicators show the current direction
  • Hold Shift and click multiple column headers to apply multi-level sorting

Pagination:

Navigate through large log datasets:

Setting Description
Page Size Select how many records to display per page — 20, 50, 100, or 200
Previous / Next Navigate between pages
Jump to Page Enter a specific page number to navigate directly
Cursor-Based Efficient pagination for very large datasets — millions of records

Viewing full event details:

  1. Click on any log row in the table
  2. A detail panel opens showing:
Field Description
All Fields Complete field values for the event
Raw Log The original unprocessed log entry
Metadata Timestamp, source, and receiver information
Related Logs Links to related audit events
  1. Click Close to return to the table view

Exporting log data:

  1. Apply your desired filters and date range
  2. Click the Export button
  3. Choose an export format:
    • CSV — for use in Excel or data analysis tools
    • Excel — native Excel format with formatting applied
    • PDF — formatted document suitable for printing or sharing
  4. Configure export options:
    • All Columns or Visible Columns Only
    • Include Headers — include or exclude column headers
    • Max Records — set a maximum record limit if needed
  5. Click Download

Large exports may be queued and delivered via email when complete. For datasets that regularly require large exports consider scheduling a report instead.

Saving and sharing views:

After applying filters and column configurations that you want to reuse:

  • Click Save to save the current configuration as a named view
  • Click Duplicate View to create a copy of an existing view as a starting point for a new one
  • Click Share to share a view with other users or roles with either View Only or Edit permissions
  • Click the Star icon to mark a view as a favorite for quick access

Auto-refresh:

For real-time monitoring keep the view updated automatically:

  1. Click the Auto-Refresh control
  2. Select a refresh interval:
    • 5 seconds
    • 10 seconds
    • 30 seconds
    • 1 minute
  3. The view reloads at the selected interval

Use auto-refresh cautiously with large datasets or broad date ranges as frequent reloads can impact performance.

Best practices:

  • Set a specific date range before applying filters — broad queries across high-volume categories without a date constraint can return very large result sets
  • Display only the columns you need for faster load times — use the Columns tab in view configuration to remove unnecessary fields
  • Use named saved views for recurring investigation tasks so you do not need to rebuild filters each time
  • For large-scale data analysis schedule a report rather than exporting directly from a view
  • Use descriptive view names so other team members can identify the right view quickly
  • Use the Related Logs link in the event detail panel when investigating incidents — it helps surface connected events that provide context around a specific activity
  • When investigating an incident start with a broad view and progressively narrow filters to zero in on relevant events rather than starting with very specific criteria that might exclude relevant context

[Your administrator should create and share a standard set of views for the most common investigation and monitoring scenarios in your environment so the team has a consistent starting point.]