--- title: Search Examples slug: neurons-for-itsm/admin-user-help/enu/latest/81Xs-search-examples createdAt: 2026-07-14T19:16:28.719Z --- The following are some examples of how to use search. ::::ExpandableHeading ## Example: Creating a Saved Search with Expressions To search for all incidents that are breaching within the next 24 hours, set up the search query fields as follows: 1. Log into Neurons for ITSM. 2. Open the **Incident** workspace. 3. Open the **Saved Searches** menu. See [Viewing the List of Saved Searches Available to Your Role](docId\:vwINWjbF5BrJccIoREsMm) for information about opening the **Saved Searches** menu. 4. Click **New Saved Search**. A blank search form appears. 5. Enter a search name, such as **Expression Example**, and click **Save**. 6. Set up your query as shown in the example below: | Business Object | Field | Operator | Criteria | | ---------------- | -------------- | ---------------- | ---------------------------------------------------------------------------------------- | | Incident | Status | In List | Active, Logged, Waiting for 3rd Party, Waiting for Customer, Waiting for
Resolution | | AND |   |   |   | | Is Related To | At least | 1 | Escalation Watch via IncidentAssociatedEscalationWatch (0...1 : 0...N) | | WHERE |   |   |   | | Escalation Watch | BreachDateTime | Greater or Equal | $(Today()) | | AND |   |   |   | | Escalation Watch | BreachDateTime | Less than | $(Tomorrow()) | :::Paragraph{indent="1"} *Example of Creating a Saved Search with Expressions* ::: ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/_588Lu5kf3eYyKaXjZac5_newsavedsearchexample.png" alt="Example of creating a saved search with expressions" position="flex-start" size="40" initialPath="../../Resources/Images/help-images/NewSavedSearchExample.png" githubPath="Content/Resources/Images/help-images/NewSavedSearchExample.png" showCaption="false" indent="1"} 7. Click **Run Search** to see the results. 8. Click **Save**. :::: ::::ExpandableHeading ## Example: Using Find and Replace You can create a quick action that enables you to find and replace specific values in specific fields in an entire saved search list, a selection of items, or a single item. The **Find and Replace** quick action looks through the records for any instances of the specified field that contain the specified current value. When it finds that field and current value, it replaces the current value with the new value. *Find and Replace Quick Action -- Before* ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/zJfM6des-VVvBybw_7U0D_findandreplacenew.png" alt="Before state for a find and replace quick action" position="flex-start" size="40" initialPath="../../Resources/Images/help-images/find_and_replace_new.png" githubPath="Content/Resources/Images/help-images/find_and_replace_new.png" showCaption="false"} In this example, the name is **Owner Change**. No description is added. The category is **Form Actions**.  (If you do not choose a category, the quick action is listed in **No Category**.) *Find and Replace Quick Action -- After* ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/10hLOQbwBwF_IRbgGOTzb_findandreplacenewqa.png" alt="Result state for a find and replace quick action showing replaced owners in records" position="flex-start" size="40" initialPath="../../Resources/Images/help-images/find_and_replace_new_qa.png" githubPath="Content/Resources/Images/help-images/find_and_replace_new_qa.png" showCaption="false"} In this example, we use the **Find and Replace** quick action created above to replace the name of an incident owner with the name of a different owner for all results in the current saved search. *Individual Incident Before Search and Replace* ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/kR-7CFPuDR0cZWqnHFBjH_findandreplaceform1.png" alt="Search and replace for an incident owner showing before state" position="flex-start" size="40" initialPath="../../Resources/Images/help-images/find_and_replace_form1.png" githubPath="Content/Resources/Images/help-images/find_and_replace_form1.png" showCaption="false"} *Incident List Before Search and Replace* ITSM In this example, the category is form actions and the name of the quick action is **Owner Change**. *Owner Change Quick Action* ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/Og6cYTEmRiApkeTGpkrsv_findandreplaceowner2.png" alt="Owner change quick action located in Form Actions menu" position="flex-start" size="40" initialPath="../../Resources/Images/help-images/find_and_replace_owner2.png" githubPath="Content/Resources/Images/help-images/find_and_replace_owner2.png" showCaption="false"} In this example, the field is Owner. The current value is **Ron B Davis** and the replacement value is **Chris Lawton**. 1. Check one of the following: - **Find results in selected rows**: Finds individual incidents that you previously highlighted. - **Find all results in current Saved Search**: Finds the entire list of incidents that is currently displayed. :::Paragraph{indent="1"} In this example, we checked **Find all results in current Saved Search**. ::: 2. Click **Replace**. :::Paragraph{indent="1"} The quick action looks through the records for instances of the **Owner** field that contain** Ron B Davis**. When it finds such an instance, it replaces **Ron B Davis** with **Clawton**. ::: :::Paragraph{indent="1"} When the quick action is finished, it displays a message with the results. ::: :::Paragraph{indent="1"} *Incident List After Search and Replace* ::: ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/KDPoIw7lf9W8sT700eqbR_findandreplaceowner5.png" alt="Incident list showing changed image owners after search and replace" position="flex-start" size="40" initialPath="../../Resources/Images/help-images/find_and_replace_owner5.png" githubPath="Content/Resources/Images/help-images/find_and_replace_owner5.png" showCaption="false" indent="1"} :::: ::::ExpandableHeading ## Example: Finding Records that will Breach This topic describes how to create a saved search that searches for records that will breech within a specific time, in this case, records that will breach in the next seven days. This search uses expressions. 1. Log into Neurons for ITSM. 2. From the Service Desk console, open a workspace. 3. Open the **Saved Searches** menu. See [Viewing the List of Saved Searches Available to Your Role](docId\:vwINWjbF5BrJccIoREsMm) for information about opening the **Saved Searches** menu. 4. Click **New Saved Search** to create a new search. See [Using a Saved Search](docId\:vwINWjbF5BrJccIoREsMm) for more information on how to create a saved search. 5. In the search criteria area, choose the following: | Business Object | Field | Operator | Criteria | | -------------------------------------------------------------------- | -------------- | ------------ | -------------------- | | Escalation Watch via IncidentAssocResolutionEscWatch (0...1 : 0...1) | BreachDateTime | Equal to | $(BeginningOfDay(7)) | | AND |   |   |   | | Escalation Watch via IncidentAssocResolutionEscWatch (0...1 : 0...1) | BreachDateTime | Greater than | $(CurrentDate()) | | AND |   |   |   | | Incident | Status | Not In List | Closed, Resolved | :::Paragraph{indent="1"} For more information, see [Using Expressions in Search.](docId:33GDBNSL3hlVHNyfXodaD) ::: :::Paragraph{indent="1"} *Example: Search the Next 7 Days* ::: ::Image[]{src="https://api.archbee.com/api/optimize/parib0MC3hVoUNdfQdnac/v6y831C_mMH_ckyEScOgB_next-7-days.png" alt="Expression criteria to locate records breaching within the next 7 days" position="flex-start" size="40" initialPath="../../Resources/Images/help-images/next 7 days.png" githubPath="Content/Resources/Images/help-images/next 7 days.png" showCaption="false" indent="1"} 6. Click **Preview** to check your search results. 7. Click **Save**. ::::