Highlight Queries

In a normal "select" query, only the matching items are shown:

In a highlight query, all items are shown with the matching items highlighted, and additional (darker) navigation buttons are available to jump to the previous/next highlighted item:

Highlight queries are only available for events, not for exes, modules, processes.

A highlight query is signified by an h at the front. You can enter a highlight query directly by starting it with q h instead of just q:

q h Path:windows

But rather than specify the h directly, there are several ways to toggle between Select and Highlight after querying:

• Ctrl-h
• Click "Select" or "Highlight" at the start of the query line above the table of items.
• Right-click an event (if querying within a single file). This also positions that event at the top of the page (or the next matching event when switching to a select query).