Hunt
Hunt overview
Search parsed records across one case or all cases.
Hunt (/UI/hunt/search) searches the index built when packages are processed.
Open Hunt
- Sidebar Hunt — scope defaults to All cases.
- Case Start Hunting — scope is the current case.
The header shows Records, the case scope dropdown, save controls, and an @timestamp search box.
Views
| View | Page |
|---|---|
| Dashboard view | Dashboard view |
| Table view | Table view |
Shared toolbar
| Control | Purpose |
|---|---|
| All cases / case picker | Limit the search. |
| View Search | Inspect the current query. |
| Table view / Dashboard view | Switch the workspace. |
| Save | Store the current search. |
| Saved Searches | Open a stored search. See Saved searches. |
@timestamp | Time-box the query. |
Hunt performance is best when you add a case scope or a field filter before you page through large result sets.