Following a Search tool search, you can select any item in the list of results from the upper right pane to view "matches" in the event details in the lower right pane. The lower, Search Detail pane summarizes the event in its left (green) area and lists the recorded event fields in the right (white) area.
Each match to the search term appears highlighted in yellow. To further investigate, you can search within the details. This is especially useful when the activity is an email, chat conversation, or long sequence of keystrokes.
To find a match within the event:
Click the Find button above the Search Detail information.
In the Find box, enter a word or phrase.
If you wish, re-enter your initial search term to jump to the next occurrence.
Otherwise, enter a new term to drill into the event.
Select Find options:
Match whole word only - find an exact match to the "Find"
term
Match case - match the Find term's upper/lower case exactly
UP - to search up the text in the matching record
Down - to search down the text in the matching record
Click Find Next to go to the next occurrence of the Find term.
Click Cancel to close the Find box.
The summary on the left displays:
Recorded Time: Date and time the event was recorded.
User: User logged in when the event was recorded.
Computer: Name of the domain (if applicable) and computer where the event was recorded.
Program: Program being used when the event was recorded.
