> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Filtering Client Sessions

> Narrow the Client Sessions list by specific criteria like user, Client, or time period, or search directly within session content.

The [Client Sessions list](/docs/session-monitoring/sessions-list) can be narrowed in two ways: by applying structured filters for specific criteria, or by searching directly within the recorded session content.

## Filter by specific parameters

Filters are applied instantly, and multiple filters can be combined — for every filter except **When**, more than one value can be selected at once.

The following filters are shown by default:

| Filter    | Narrows sessions by                                                                                                                      |
| --------- | ---------------------------------------------------------------------------------------------------------------------------------------- |
| **Who**   | The user logged in to the Client computer.                                                                                               |
| **Where** | The specific Client.                                                                                                                     |
| **When**  | A time period. Choose **Within the last** *N* hours/days/weeks/months, or a custom **Between** start and end date, then click **Apply**. |

Click **More Criteria** to add any of these additional filters:

| Filter                                          | Narrows sessions by                                                                                                 |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **Operating System**                            | Session platform: Linux Desktop, Linux X forwarded, Linux/Unix Terminal, macOS, or Windows.                         |
| **Start**                                       | Session start date and time.                                                                                        |
| **Finish**                                      | Session end date and time. Empty for **Live** sessions.                                                             |
| **Last Activity**                               | Date and time of the last screen capture or Linux command executed.                                                 |
| **Duration**                                    | Session length. Empty for **Live** sessions.                                                                        |
| **Type**                                        | Session status: **Live** or **Finished**.                                                                           |
| **Secret Usage**                                | The name of a [secret](/docs/pam/secrets/view-manage-secrets) used during the session.                                   |
| **IPv4** / **IPv6**                             | The Client computer's IP address.                                                                                   |
| **Remote IPv4** / **Remote IPv6**               | The local originating IP address.                                                                                   |
| **Remote Public IPv4** / **Remote Public IPv6** | The public originating IP address.                                                                                  |
| **Domain**                                      | The domain the Client belongs to.                                                                                   |
| **User's Comments**                             | The user's login comment, or (for remote Linux X-forwarded sessions) the application name after `x-forwarded app:`. |
| **Client Description**                          | The Client's custom description.                                                                                    |
| **Client Groups**                               | The Client group the Client belongs to.                                                                             |
| **Remote Host Name**                            | The name of the remote host computer.                                                                               |

To remove an added filter, click the **X** next to its button.

<Frame caption="Client Sessions filters, with several More Criteria options added.">
  <img src="https://mintcdn.com/syteca/FKrkO8bEqEQ6WSgs/images/session-monitoring/filtering-client-sessions-criteria.png?fit=max&auto=format&n=FKrkO8bEqEQ6WSgs&q=85&s=92fea1f21a5c9abe780d1723d260c97d" alt="Client Sessions page showing filter fields including Who, Where, When, and additional criteria" width="1902" height="895" data-path="images/session-monitoring/filtering-client-sessions-criteria.png" />
</Frame>

## Search session data

The **Search** box (top right of the page) filters the session list by a keyword or partial keyword, searching across:

* Application names
* Activity titles
* Keystrokes
* Clipboard text data
* URLs
* Linux commands and parameters
* Alert names
* USB rule names
* Linux command output

<Note>
  Searching keystroke data, clipboard data, or Linux command output requires selecting the corresponding checkboxes from the drop-down next to the Search box (the **···** button, top right). The "Search in output (Linux)" checkbox only appears if at least one Linux session has been recorded.
</Note>

### Search using a keyword list

<Steps>
  <Step title="Create a keyword file">
    Create a `.txt` file listing the keywords to search for, one per line or separated by spaces.
  </Step>

  <Step title="Upload the file">
    Click **Browse** next to the Search box and select the `.txt` file.
  </Step>

  <Step title="Run the search">
    Click the search icon.
  </Step>
</Steps>

<Warning>
  Searching a large number of keywords, or across a large number of sessions, can take considerable time and affect Application Server performance.
</Warning>

<Note>
  The search is performed on the sessions currently displayed in the Client Sessions list, in the current sort order — apply filters first to narrow the search scope if needed.
</Note>

## Related

<CardGroup cols={2}>
  <Card title="Client Sessions list" icon="list" href="/docs/session-monitoring/sessions-list">
    The full session list this page's filters and search apply to.
  </Card>

  <Card title="Alerts" icon="bell" href="/docs/session-monitoring/alerts">
    Trigger notifications on keyword or activity matches, instead of searching after the fact.
  </Card>

  <Card title="Secrets" icon="key" href="/docs/pam/secrets/view-manage-secrets">
    Filter sessions by which secret was used during them.
  </Card>

  <Card title="Client groups" icon="users" href="/docs/administration/clients/client-groups">
    Group Clients to filter and manage sessions collectively.
  </Card>
</CardGroup>
