Selecting & Filtering Fields

LogScale allows selecting single fields and offers searching and filtering on those fields.

  1. Click on a field in the Fields panel (Figure 50, “Fields Panel”) e.g., #severity in the example. A window pops up with the list of values found and the number of occurrences for each.

    Selecting Fields

    Figure 52. Selecting Fields


  2. Click the ⋮ icon next to each field name to get several filtering options.

    Filtering Options

    Figure 53. Filtering Options


  3. Select one of the options, for example Aggregate → Group by value will group events by the value of that field, Timechart → Use field as series will run the timeChart() function in the Query editor to show events that have that field grouped into series and plotted in a timechart.

More filter options and interactions with fields are available e.g., exclude () or include (⊜) in the search all events that have the selected field. See Field Interactions.

When the menu is opened for Field Interactions with live queries, the Fields panel flyout will display a fixed list of top values. The top values are kept from the point in time when the menu was opened.