---
title: "DNS Users"
canonical: "https://docs.infoblox.com/space/BloxOneThreatDefense/35375394/DNS%20Users"
format: markdown
---
*The Users *tab provides information on users associated with DNS activity hitting the web filters assigned to a policy on your network. To export the *Users* table data in csv format, click **Export**. The default file name is *dns-activity_users.csv*. Exported data is limited to 10,000 records.
## Performing Search Queries
The search feature supports using queries to perform searches using the integrated search query language. Using the search query language, you can search all records in the *Security Events* report with customized queries. Using the search query options available in the *DNS Users *report, you can:
- Run a search on any of the following fields:
- **DEVICE NAME**
- **DHCP FINGERPRINT**
- **DNS VIEW**
- **MAC ADDRESS**
- **OS VERSION**
- **QUERY**
- **QUERY TYPE**
- **RESPONSE**
- **SOURCE**
- **USER**
- The **= **and the **NOT (!=)** operators
- Use the **AND** and the **OR** operators.
- Use **single** and **double **quoted to enter values with spaces.
- Use parentheses to group search parts.
- Use the **wildcard symbol (*) **as the last character of the search value for a partial match.
- Use the **ENTER** key to apply search.
- Use the **TAB** key to autocomplete search with the first available suggestion.
- **Source**
- **Response**
- **Query Type**
- **Query**
- **DNS View**
- **Device**
- Use **AND** and **OR** operators.
- Use **single** and **double **quoted to enter values with spaces.
- Use parentheses to group search parts.
- Use the **wildcard symbol (*) **as the last character of the search value for a partial match.
- Use the **ENTER** key to apply search.
- Use the **TAB** key to autocomplete search with the first available suggestion.
## Sample Search Queries
The following are search query examples:
-
- *query=domain.*AND device=52.123**
- device = office1.domain OR device=office2.domain.com
- dns_view=example-view AND query_type=A
- (source=‘Infoblox Endpoint’ OR source=“example 1”) AND device=52.123*
Search by the query fields matches values by subdomains. E.g. query = domain.com
matches
'domain.com', 'office.domain.com', 'space.office.domain.com
> ⚠️ **Note**
> ⚠️
> ⚠️ All search values are case sensitive. A maximum of five operators can be used when constructing a query search.
## Filtering the Users Tab
To filter* User *events by specific criteria, select the applicable objects from the following drop-down menus located below the top action menu:
- **Source**: The location of the device within the network infrastructure. For example, the device can be an **on-prem** appliance or an **endpoint** device. You can select which records to view by selecting or deselecting from among the options available. When filtering by source, the filter drop-down is limited to showing 10 sources.
- **Show**: Security and activity events can be filtered by choosing an option from the **Show** drop-down menu.
The *Users *table displays the following information by specific criteria, where you can select the applicable objects from the following column drop-down menus:
- **REQUESTS**: The request type. Clicking the number of requests in the **REQUESTS** column associated with a user allows you to pivot off the record and display all DNS events associated with the user.
- **DEVICES**: The number of devices that are used to access the corresponding DNS content. Clicking the number of requests in the **DEVICES** column associated with a user allows you to pivot off the record and display all DNS events associated with the user.
- **USER**: The user that triggered the hit. For remote offices, the portal displays **Unknown** for these users.
## Export Records
Click **Export** to download a CSV file of report records. The maximum number of exported DNS Users report records is **10,000**.