Selecting & Filtering Fields

LogScale allows selecting single fields and offers searching and filtering on those fields.

  1. Click on a field in the Fields panel (Figure 49, “Fields Panel”) for example, #severity in the example. A window opens with the list of values found and the number of occurrences for each.

    Selecting Fields

    Figure 51. Selecting Fields


  2. Click the ⋮ icon next to each field name to get several filtering options.

    Filtering Options

    Figure 52. Filtering Options


  3. Select one of the options, for example, Aggregate → Group by value will group events by the value of that field, Timechart → Use field as series will run the timeChart() function in the Query editor to show events that have that field grouped into series and plotted in a timechart.

More filter options and interactions with fields are available for example, exclude () or include (⊜) in the search all events that have the selected field. See Field Interactions.

When the menu is opened for Field Interactions with live queries, the Fields panel flyout will display a fixed list of top values. The top values are kept from the point in time when the menu was opened.