Network Management

Log Analyzer Compound Search

This article provides detailed information about compound search support in the Log Analyzer, including Boolean operator rules, UI syntax behavior, evaluation precedence, and troubleshooting steps.

First published date

5/1/2026 5:19 PM

Last published date

5/1/2026 5:19 PM

Overview

Starting with SolarWinds Observability Self-Hosted version 2026.2, you can use compound (Boolean) search expressions in the Log Viewer search bar. This article describes the syntax rules, operator behavior, operator precedence, use case examples, and known limitations of the compound search feature.

Product section

Log Analyzer

Resolution

Boolean Keywords & Syntax

The Log Analyzer supports Boolean operators AND and OR under the following conditions:

  • Operators must be in uppercase.
  • There must be a single space before and after the operator.
  • Operators must appear between words or sentences.
  • No parentheses are supported.

Examples of valid expressions:

  • Text1 AND Text2
  • Text1 OR Text2
  • Text1 AND Text2 OR Text3

Invalid expressions (treated as plain text):

  • Text1ANDText2
  • And
  • Text1 AND
  • AND Text2
  • Text1ORText2

UI Syntax Representation

When valid Boolean operators are identified, the Log Analyzer UI formats them as follows:

  • AND → <AND> (orange)
  • OR → <OR> (light green)

Expression Display Examples:

  • Text1 AND Text2 → Text1 <AND> Text2
  • Text1 OR Text2 → Text1 <OR> Text2
  • Text1 AND Text2 OR Text3 → Text1 <AND> Text2 <OR> Text3

 

A screenshot of a graphAI-generated content may be incorrect.

Operator Precedence

AND has higher precedence than OR during evaluation.

  • Text1 AND Text2 OR Event → (Text1 AND Text2) OR Event
  • Text1 OR Text2 AND Alpha → Text1 OR (Text2 AND Alpha)
  • Text1 AND Text2 OR Text3 AND Text4 OR Text5 → (Text1 AND Text2) OR (Text3 AND Text4) OR Text5

 

AND/OR defines

AND - Will return results which must match ALL applied filters. 

OR - Will return results that can match ANY applied filters.

IP Address search

When any IP address search is performed, either a partial IP or a full IP address search, with or without a compound search, then it will return all the messages containing that IP text, along with the whole message from the matching IP source.

Troubleshooting

If you encounter database timeout errors when executing complex queries,

follow these steps:

Modify the timeout value in minutes (default: 1 minute).