Every signed-in screen has a search box at the top of the console. Type an IP, MAC, hostname, CIDR, or DNS name. Open lands on the object, not on a generic list.
MACs: colons, hyphens, Cisco aabb.ccdd.eeff, or 12 hex. Last three octets are enough. A full MAC also loads the timeline. Occupancy over time (who held this IP, where this MAC has been, which NICs this hostname used, what sat on this switch port) is History.
What it finds
| Kind | Match | Open |
|---|---|---|
lease | IP, MAC, or hostname | Leases, that IP |
reservation / assignment / exclude | IP, MAC, hostname | Subnet map with ?ip= |
subnet | CIDR, or an IP in the CIDR | /subnets/{id} |
prefix | CIDR / description | Addresses (/plan) |
dns | static record name or rdata | /dns |
nak | Why NAK | Work or subnet |
No hits: No hits for <query>. Empty box does nothing.
This is a lookup, not a replacement for Leases filters (state, client-id, subnet dropdown). Use Leases when you need force-release. Use search when someone says “what is 10.20.20.55?” Use History when they ask who had it last Tuesday, or what sat on a switch port. The whole VLAN last Tuesday is As of on the subnet address map.
Fleet search is a different bar: MAC, IP, hostname, subnet, or reservation across every connected cluster. The hit names the site and opens that cluster’s live console. Use it when you do not know which site has the laptop.
API
curl -s -H "authorization: Bearer $TOKEN" \
'http://127.0.0.1:8080/api/v1/search?q=10.20.20.55'
Response: { "query": "…", "hits": [ { "kind", "id", "title", "detail", "href" } ] }. Readonly may search.