Searching for events whose trigger is End of Session or whose reporting is set to Report last occurrence can require adjustments to your search timeframe, as the event time associated with these events is in the past because of the must wait for the session timeout.

Note: If you create hit attributes from the request buffer, note that the [HitType] section and [TLFID_*] sections (where * is the identifier for the fact) are generated by the event engine and cannot be detected in live sessions. As a result, any events by using these hit attributes do not fire in the Windows™ pipeline and are therefore not available for searching. They do fire, however, when they are evaluated in the Event Tester on sessions that are already passed through the Canister.

Note: You can search for inactive events, which can contain no data, as long as they are configured for display in the Portal. You cannot search for events that are configured to discard the session.

When you search for active sessions for events, the Event Selector does not contain events that meet any of the following conditions:

• Events that are triggered on the End of Session or Last Hit triggers have not been triggered yet for active sessions.
• Events that are configured to report the last occurrence, which cannot be assessed until the session is closed.

Events that meet any of the conditions mentioned are filtered from the Event Selector.

1. In the Event in the Search Configuration area of the Search page, select Include or Exclude.
   • Include - returns sessions that include the data specified in the search. This is the default setting.
   • Exclued - returns sessions that exclude the data specified in the search.
2. Click Select Event to launch the Event Selector.
3. Select an event.

   Note: When you select an event, by default, the search configuration looks for the event in combination with any dimension. If needed, you can look for instances of the event that match only a selected dimension.

   Dimensions can be configured to capture contextual information from the session at the time when an event occurs. For example, you can capture into a dimension the value of the URL for the page where the event occurred.

   By default, the dimension filter is set to <Any Dimension>, which corresponds to the No Report Group Dimension.

4. Optional: To apply a dimension filter, click Select Dimension.
5. In the Dimension Selector, filter the displayed dimensions .
6. Select a dimension.

   Note: You cannot directly search for null values. To search for a null value, perform a not includes operation on the non-null dimension values.

   Note: You cannot search for a specified dimension without selecting a value. Wildcard searches on a dimension value are not supported.

7. After you select a dimension value, click Select.

   The Event search term is updated with a reference to the name of the dimension and the value you selected.

   Dimensions and their values are configured in the Event Manager.

   Note: If multiple facts are available that meet the search criteria, the oldest dimension is selected based on creation time, since it is likely to have the most data.