Am I the only one who finds the log search syntax clunky?

I've been working with LogRhythm for several years now, primarily for SOX compliance evidence collection and general security monitoring. While I appreciate the platform's depth and the robustness of its log collection, I consistently find myself wrestling with the search syntax in the AI Engine or even in basic log searches. It feels unnecessarily opaque compared to more modern query languages.

For instance, performing what should be a simple join or correlation often requires a cumbersome multi-step process. Let's say I want to see failed login attempts followed by a successful login from the same source IP within a short timeframe. In other SIEMs I've used, this might be a relatively straightforward query. In LogRhythm, I often end up breaking it down into separate searches and trying to manually piece the timeline together, or I have to invest significant time in building a custom AI Engine rule that feels more complex than the logic warrants.

Here’s a basic example of a syntax quirk that trips me up: the use of parentheses and operators doesn't always follow a standard logic I'd expect from other query languages. The need to be hyper-specific about object types (like `log.source` vs `entity.name`) before the system even begins to understand the intent slows down exploratory analysis.

* The field naming conventions seem inconsistent between different log sources unless they're normalized, which requires knowing the exact Common Event Model mapping.
* Time range filters work well in the UI, but incorporating them programmatically into a complex query string feels tacked on.
* Wildcard usage and substring matching sometimes behave unpredictably, especially when dealing with Windows event log data where the XML payload is involved.

I don't want to dismiss the tool entirely—its log processing pipeline and archive are solid. But the front-end search experience, the part where an analyst or auditor needs to ask rapid, ad-hoc questions of the data, seems to be an afterthought. It lacks the fluidity of Splunk's SPL or even the guided search builders found in tools like Sentinel or QRadar.

Has anyone else developed a set of workarounds or a personal "cheat sheet" for efficient searching? I'm particularly interested in how other compliance-focused users (handling HIPAA, GDPR, etc.) structure their searches to validate controls or investigate incidents without losing hours to syntax battles. Perhaps I'm missing a fundamental understanding of how LogRhythm expects users to interact with its stored data.