Look Up Events

The Search page supports event interactions in Table widgets when results contain an @id value. Use this option to look for specific events through their IDs.

To look up an event:

  1. Locate a row in the search results

  2. Select the three-dot menu ⋮ in that row → Lookup events

    Lookup Events row interaction

    Figure 87. Lookup Events


  3. The Search page opens. It displays a query in this format:

    logscale Syntax
    in(@id, values=[idnumber])

    The query looks for details on that specific event. The query returns the @rawstring field in the results.

Look up events with multiple IDs

The feature supports cases where multiple @id values are combined into a single string.

For example, this occurs when using the collect() function:

logscale Syntax
groupby(fieldName, function=collect(@id))

When you select the Lookup events interaction in a row, the Search page opens a query in this format:

logscale Syntax
in(@id, values=["idnumber1", "idnumber2", "idnumber3"])

The query splits the results into multiple ID values when they are separated by \n or ,.

The video shows how the feature works with this example query:

logscale
groupby(method, function=collect(@id, separator=","))

Timestamp highlight

When looking up events, the Table widget supports timestamp visualization. When the table results include @timestamp fields, hovering over a table row highlights the corresponding time period in the histogram with a blue bar: