Unified search

What is the unified search?

The unified search gathers log files from EPM Cloud for Linux. Event log information is retrieved from databases.

Run a unified search

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. Click** > Endpoint Privilege Management for Linux > Unified Search.**
   The Unified Search page displays.
3. Click Search to search everything, or enter a search query to display the list of events. Search options include:
   • Fuzzy / partials matches: Default. Searching for tree, for example, returns results with tree and pinetree.
   • Exact matches: Use double quotes. Searching for “sudo”, for example, and results only contain sudo.
   • Logical AND: Results must have both values, as in sudo AND emacs.
   • Logical OR: Results may contain either value, as in sudo OR emacs.
   • Logical NOT: Results will exclude value, as in sudo NOT visudo.
   • Operator precedence: Using brackets, as in (sudo AND emacs) or (sudo AND vi).
   • Date and time options: Use these to set ranges, including some defaults, and the ability to set begin and end times.

ℹ️

Note

When writing your query, you do not need to capitalize the logical operators (and, or, not).

The result count appears at the bottom right of the grid (as number of items). At the bottom of the grid, you can also find the page count, along with the page navigation icons.

View event details

1. From the search results, click a row.
   The Event Details panel opens on the right and the event details display.

Download the search results

You can download the search results as a JSON or CSV file.

1. From the search results, click the Download icon.
2. Select JSON File or CSV File.
   The file downloads to your Download folder.