# CloudWatch search expression examples
The following examples illustrate more search expression uses and syntax. Let's start with a search for `CPUUtilization` across all instances in the Region and then look at variations.
This example displays one line for each instance in the Region, showing the `CPUUtilization` metric from the `AWS/EC2` namespace.
```
SEARCH(' {AWS/EC2,InstanceId} MetricName="CPUUtilization" ', 'Average')
```
Changing `InstanceId` to `InstanceType` changes the graph to show one line for each instance type used in the Region. Data from all instances of each type is aggregated into one line for that instance type.
```
SEARCH(' {AWS/EC2,InstanceType} MetricName="CPUUtilization" ', 'Average')
```
The following example aggregates the `CPUUtilization` by instance type and displays one line for each instance type that includes the string `micro`.
```
SEARCH('{AWS/EC2,InstanceType} InstanceType=micro MetricName="CPUUtilization" ', 'Average')
```
This example narrows the previous example, changing the `InstanceType` to an exact search for t2.micro instances.
```
SEARCH('{AWS/EC2,InstanceType} InstanceType="t2.micro" MetricName="CPUUtilization" ', 'Average')
```
The following search removes the `{metric schema}` part of the query, so the `CPUUtilization` metric from all namespaces appears in the graph. This can return quite a few results because the graph includes multiple lines for the `CPUUtilization` metric from each AWS service, aggregated along different dimensions.
```
SEARCH('MetricName="CPUUtilization" ', 'Average')
```
To narrow these results a bit, you can specify two specific metric namespaces.
```
SEARCH('MetricName="CPUUtilization" AND ("AWS/ECS" OR "AWS/ES") ', 'Average')
```
The preceding example is the only way to do a search of specific multiple namespaces with one search query, as you can specify only one metric schema in each query. However, to add more structure, you could use two queries in the graph, as in the following example. This example also adds more structure by specifying a dimension to use to aggregate the data for Amazon ECS.
```
SEARCH('{AWS/ECS ClusterName}, MetricName="CPUUtilization" ', 'Average')
SEARCH(' {AWS/EBS} MetricName="CPUUtilization" ', 'Average')
```
The following example returns the Elastic Load Balancing metric named `ConsumedLCUs` as well as all Elastic Load Balancing metrics or dimensions that contain the token `flow`.
```
SEARCH('{AWS/NetworkELB, LoadBalancer} "ConsumedLCUs" OR flow ', 'Maximum')
```
The following example uses nested grouping. It returns Lambda metrics for `Errors` from all functions and `Invocations` of functions with names that include the strings `ProjectA` or `ProjectB`.
```
SEARCH('{AWS/Lambda,FunctionName} MetricName="Errors" OR (MetricName="Invocations" AND (ProjectA OR ProjectB)) ', 'Average')
```
The following example displays all of your custom metrics, excluding metrics generated by AWS services.
```
SEARCH('NOT Namespace=AWS ', 'Average')
```
The following example displays metrics with metric names, namespaces, dimension names, and dimension values that contain the string `Errors` as part of their name.
```
SEARCH('Errors', 'Average')
```
The following example narrows that search to exact matches. For example, this search finds the metric name `Errors` but not metrics named `ConnectionErrors` or `errors`.
```
SEARCH(' "Errors" ', 'Average')
```
The following example shows how to specify names that contain spaces or special characters in the metric schema part of the search term.
```
SEARCH('{"Custom-Namespace", "Dimension Name With Spaces"}, ErrorCount ', 'Maximum')
```
## CloudWatch cross-account observability search expression examples
**CloudWatch cross-account observability examples**
If you are signed in to an account that is set up as a monitoring account in CloudWatch cross-account observability, you can use the **SEARCH** function to return metrics from specified source accounts. For more information, see [CloudWatch cross-account observability](CloudWatch-Unified-Cross-Account.md).
The following example retrieves all Lambda metrics from the account with the account ID 111122223333.
```
SEARCH(' AWS/Lambda :aws.AccountId = 111122223333 ', 'Average')
```
The following example retrieves all `AWS/EC2` metrics from two accounts: 111122223333 and 777788889999.
```
SEARCH(' AWS/EC2 :aws.AccountId = (111122223333 OR 777788889999) ', 'Average')
```
The following example retrieves all `AWS/EC2` metrics from the source account 111122223333 and from the monitoring account itself.
```
SEARCH(' AWS/EC2 :aws.AccountId = (111122223333 OR 'LOCAL') ', 'Average')
```
The following example retrieves the `SUM` of the `MetaDataToken` metric from the account `444455556666` with the `InstanceId` dimension.
```
SEARCH('{AWS/EC2,InstanceId} :aws.AccountId=444455556666 MetricName=\"MetadataNoToken\"','Sum')
```