How to build criteria using Search for custom report in EventLog Analyzer?
Objective
This article provides step-by-step instructions for creating custom report criteria using the Search tab. This option delivers a smoother experience and simplifies the process of building criteria for custom reports.
Prerequisites
Administrative role on the EventLog Analyzer user interface or "Create and Manage Reports" and "Perform Log Search" option.
Knowledge of the data sources and events you want to include in the report
Knowledge of what report you would like to create and how filter can be built.
Steps to follow
Log in to EventLog Analyzer and open Search tab.
Select the Log sources and Log type
Refer How to perform Basic log search in EventLog Analyzer/How to Perform Advanced Log search in EventLog Analyzer to search for the results that you would like to get. Alternatively, you can follow the below steps to build the criteria from the Search results.
Scroll down to see the events for which you would like to build the criteria. You can select the Field name to see the top 10 and least 10 values.
You can choose the Field value from the above Top & Least value popup or choose the Field Value directly from the Search as shown below.
Click Add to add the condition in the criteria as shown below.
NOTE: You can choose Add/Remove Fields option to enable all available Predefined Fields/Custom Fields to build the criteria using them.
Follow the same process of clicking the Field values to add them in criteria.
Once you build the criteria and see the same under results, choose Save As and select Save as Report
You will be redirected to Custom Reports page where the criteria built and device selected in the Search tab will be auto populated serving you an easier way to build criteria for your custom report by seeing the results.
Proceed further to select the Report Type and add other details to finish setting up Custom Report.
Tips
Build the report criteria effectively to get the results to achieve the requirement.
Regularly review and update your custom reports to ensure they meet your changing requirements.
Related topics and articles
Custom Report in EventLog Analyzer
New to ADSelfService Plus?
Related Articles
How to Extract New/Custom Fields from Log Data Using Log Search in EventLog Analyzer
Objective This article offers you the steps to extract new fields from log data in EventLog Analyzer. It will guide you through the process of defining and extracting custom fields to enhance log analysis and reporting. Prerequisites Access to ...Troubleshooting Incorrect Severity in EventLog Analyzer Custom Report
Overview This document provides guidance to identify and resolve issues where the severity levels in EventLog Analyzer custom reports appear incorrect, ensuring accurate and reliable reporting. Possible Causes Misconfigured severity mapping in ...How to create Custom Parser or Format in EventLog Analyzer
Objective Creating Custom Log format option is available in EventLog Analyzer from build 12435 onwards, which offers you a flexibility to create your own Log formats. You can create multiple custom parsing rules within them to extract multiple fields ...Troubleshooting: The report export does not have the message field in EventLog Analyzer
Issue description In EventLog Analyzer, users may encounter that the Message field is not available while exporting specific reports. This typically occurs when the selected report or its associated data source lacks the inclusion of the Message ...Introduction to EventLog Analyzer
What is log management? An enterprise network consists of different entities—perimeter devices, workstations, servers, applications, and more. Each entity records every activity that unfolds within it in the form of logs. These logs hold information ...