Search Builder

StackHash supports rich searching and filtering of events. Enter search criteria by selecting a field to search (or all fields) and the type of search. The list of fields includes all of the columns from the event, cab and hit lists.

For text fields you can search for text within the field. The search is not case sensitive.

For numeric or date fields you can search for matches that are less than, greater than or equal to a value. When searching dates you can enter an absolute date (July 13, 2010) or a relative number of days or months (-7 days).

To create an AND search click the add field (Add Field) button to add additional fields. You can remove unwanted fields by clicking the remove field (Remove Filed) button.

To create an OR search click the add criteria (Add Criteria) button. Remove unwanted OR searches by clicking the remove criteria (Remove Criteria) button.

Search Text displays a compact representation of the current search. You can type this directly into the search box instead of using the Search Builder. The following characters have special meanings in a StackHash search:

[]Square brackets are used to name a search. Place the name first and then the rest of the search expression within the brackets.
(), OREach OR component of the search is contained in round brackets separated by OR. The brackets are optional if the search only contains AND criteria.
spaceEach AND search is separated by a space. Spaces within a search must be quoted.
"Quotes allow you to use space characters within a search expression.
:Indicates searching a text field for matches that contain the search expression (case insensitive).
!Indicates searching a text field for matches that do not contain the search expression (case insensitive).
=Indicates searching for an exact match in a numeric or date field.
>Indicates searching for a greater than match in a numeric or date field.
<Indicates searching for a less than match in a numeric or date field.

The following search string demonstrates all of the special characters:

My Search [(app:crashy ehits>100 ccreated<"-12 months" offset=0x12) OR (mod:kernel32)]

The search is called ‘My Search’ and will look for events matching:

Application Name contains ‘crashy’ AND hit count is greater than 100 AND at least one cab was created more than a year ago AND the crash offset is 0x12
OR
Module name contains ‘kernel32’

When entering a search you can click the Search Builder button at any time. StackHash will try to parse what you've entered and you can then add or adjust criteria visually. You can also use this capability to refine searches rather than starting again from scratch.

Named searches appear first in the most recent search list (click the drop down next to the search box), followed by your most recent unnamed searches. You can remove a search from the list by right-clicking it and then choosing Remove from the context menu.

See Also:

StackHash | © Copyright Cucku, Inc and the stackhash.codeplex.com contributors.