Selecting & Filtering Fields

LogScale allows selecting single fields and offers searching and filtering on those fields.

  1. Click one field in the Fields Panel (Figure 48, “Fields Panel”) e.g., #severity in the example. A window pops up with the list of values found and the number of occurrences for each:

    Selecting Fields

    Figure 50. Selecting Fields


  2. Click the small menu icon ⋮ next to each field name to get several filtering options.

    Filtering Options

    Figure 51. Filtering Options


  3. Click one of the options, for example Aggregate → Group by value will group events by the value of that field, Timechart → Use field as series will run the timeChart() function on the Search box to show events that have that field grouped into series and plotted in a timechart.

More filter options and interactions with fields are available e.g., exclude or include in the search all events that have the selected field. See Field Interactions.

When the menu is opened for Field Interactions with live queries, the Fields Panel flyout will display a fixed list of top values, these values are kept from the point in time when the menu was opened.