Event Id: Windows Security Event Id 1000, Event Id 11, Event Id Net, Event Id 4,

Search is governed by simple set of rules. Here is the quick list of Tips to refine and improve search

! No wild character support.

Operator	Alternate	Example
AND	and (not case sensitive) &	123 and "sql server" 123 & "sql server"
OR	Or (not case sensitive) \| (Pipe)	Id=123 or EventTracker Id=123 \| EventTracker
Operator must be separated by space otherwise it will be considered as part of search string and will be ignored.

Search Example	Find EventTracker Containing...
Server Database	The words server or database will be searched in Event Source and Description
Microsoft Exchange	The exact phrase Microsoft Exchange will be searched either in Event Source or Description
1000 - 2354	Finds events with Event ID Range between 1000 and 2354
Eve	Matches for the word eve in Event Source or Description eve can match in EventTracker. eve can match in events. eve can match in severe system-level. eve can match in To achieve optimal performance
Event id = 1000 or Event id: 1000 Evtid = 1000 or Evtid: 1000 Eventid = 1000 or Eventid: 1000 Eid = 1000 or Eid : 1000 Event_id = 1000 or Event_id: 1000 Id =1000 or Id: 1000	Matches for Event id = 1000
Event source = sql or Event source: sql Event_source = sql or Event_source: sql Eventsource = sql or Eventsource: sql Evtsource = sql or Evtsource: sql Source = sql or Source: sql Src = sql or Src : sql	Matches for Event source containing the word “sql” at the Beginning and Description containing “sql” term anywhere Source: SQLSERVER/MSDE Source: SQLANYs Images Source: SQLCTR60 User validated on MsSql server
Evtid = 1000 and src = iisinfoctrs Evtid : 1000 and src : iisinfoctrs	Matches for Event id = 1000 AND Event source = iisinfoctrs
Evtid = 1000 or src = iisinfoctrs Evtid : 1000 or src : iisinfoctrs	Matches for Event id = 1000 OR Event source = iisinfoctrs
Description = Invalid cryptographic key... Desc = Invalid cryptographic key... Description: Invalid cryptographic key... Desc: Invalid cryptographic key... Note: Double quote is required if contains space in parameter	Searches for the words Invalid, cryptographic, key in the description part
Id = 424 and “Desc = Invalid cryptographic key...” Id = 424 and “Desc: Invalid cryptographic key...” Note: Double quote is required if contains space in parameter	Matches the Id in Event id and exact phrase Invalid cryptographic key... in description.