Investigations let you query the real-time database and look for specific information about objects, activities or events.
To create a new investigation in the Finder, you have different choices:
Create a quick investigation to run it immediately. Optionally, save the investigation later.
Create a named investigation and save it at the time of creation for later reuse.
Duplicate an existing investigation that is similar to the investigation that you want to create.
Save or edit a drill-down or a one-click investigation from its list of results.
Creating a quick investigation
To create a quick (unnamed) investigation in the Finder:
Click the New Investigation button at the bottom of the start page.
Click the Run button to execute the investigation that you just created.
Optional: if you want to save the investigation, press Ctrl+S or click the floppy disk icon at the top right corner of the window that displays the list of results.
Creating a named investigation
To create a named investigation in the Finder:
Go to the Investigations section on the left-hand side of the main window.
If you want to place the investigation at the top level of the investigations tree, right-click the header or the empty area of the sub-section My investigations.
If you want to place the new investigation inside a particular folder, right-click one of the folders of the sub-section My investigations.
Select Create new investigation from the context menu.
A new investigation with the temporary name Untitled investigation n, where n is a growing number to avoid name collisions, shows up in a new tab. Optional: Click the name of the investigation and replace it with an appropriate name.
Optional: Click the field below the name of the investigation labeled Enter description here... and give a short description of the purpose of the investigation.
Click Save & Run to save the new investigation an execute it right after.
Duplicating an existing investigation
Creating an investigation from scratch can be a lengthy process because of the many options and settings available for editing the investigation. If you already have at your disposal an investigation that is similar to the investigation that you want to create, you can save a lot of time by duplicating the existing investigation and adapting it to your needs, instead of going through the whole process of creating a new investigation.
To duplicate an existing investigation:
Find the investigation to duplicate in the Investigations section of the accordion.
Right-click the investigation name and select Duplicate from the context menu. A new investigation with the name Copy of A, where A is the name of the existing investigation, is created. A new tab opens the investigation for editing.
Optional: Click the name of the investigation and change it to something more meaningful than Copy of A.
Optional: Change the description of the investigation to reflect the purpose of the new investigation.
Modify the investigation options. Because you selected a similar investigation, there should be only a few options to change.
Click on Save & Run to save the investigation and execute it right away.
Saving after navigation
When you navigate through results by drilling-down or executing a one-click, you are effectively executing a new investigation that the Finder creates on the fly. The investigation is discarded as soon as you close the tab that displays the list of results of the drill-down or one-click. However, if you think that the investigation is useful and that you might need it later, you can save it before closing the list of results.
To save an investigation generated by a drill-down or a one-click from its list of results, either:
Click the floppy disk (save) icon in the top right corner of the window and give a name to the investigation.
Click the pencil and paper (edit) icon placed to the right of the save icon. You are asked to save the investigation with a name. Additionally, you can edit the investigation settings.