Thanks for the response. I already have LEM configured to collect raw messages, but I guess I'm not sure now how I search the raw data.
This line from the link you provided is what's confusing:
nDepth uses RAW data (the original log) and is different from the nDepth Search performed in the LEM console at Explore > nDepth.
So if nDepth from the LEM console is not searching the raw data, how do I access the raw logs?