• The first example will search for log messages with a source IP of 172.16.86.11 and a service of HTTP. Because it is not specified, the and operator is assumed, meaning that both conditions must be met for the log message to be included in the search results.

• The second example will search for any log messages with source IP addresses that start with either 172.16 or 172.18. Notice the use of the * wildcard. The use of the or operator means that either condition can be met for the log message to be included in the search results.

• The third example will search for any log message that do not have a source IP address of 172.16.86.11 and a service of HTTP. The use of the and operator means that both conditions must be met for the log message to be excluded from the search results.