Search and Display Data in LogScale

Learn how to search and analyze your data

Path 1

Search Data

Learn the basics of searching a repository

Start searching data by entering queries in the Query Editor. Learn about event fields and how to check search status. Perfect for those new to searching and querying data in LogScale.

  • Query Editor
  • Event Fields
  • Check Search Status
Start Here Path 2

Customize Results Display

Improve how search results are displayed

Learn how to customize the display of search results. Select which fields to display, format columns, apply highlighting, and change how data is visualized.

  • Display Fields
  • Format Columns
  • Filter Highlighting
  • Change Data Display
  • Changing Events Display
Get Started Path 3

Refine Search Results

Filter and adjust search results

Refine your search results by selecting specific fields, expanding time frames, and adjusting time zones. Perfect for users who want to drill down into their data.

  • Selecting Fields
  • Expand Timeframe
  • Set Timezone
Get Started Path 4

Search Deeper

Get more information from search results

Go deeper into search results by inspecting individual events, viewing context, and using interactive features. Learn about field interactions and aliasing for advanced analysis.

  • Inspecting Events
  • Show Context
  • Search Interactions
  • Field Interactions
  • Field Aliasing
Get Started Path 5

Save and Export Search Results

Save queries and export data

Learn how to save your search queries for future use and export search results in various formats. Essential for users who need to share or archive their findings.

  • Saving Searches
  • Data Export
Get Started

Path 1: Search Data

Learn the basics of searching a repository. Understanding these fundamentals makes searching data straightforward and effective.

1

Query Editor

To start searching data, enter a query in the Query Editor

Query Editor

guidebeginner

The primary interface that enables robust, fast regex searches of server logs and metrics in your repositories
2

Event Fields

Learn about event fields for easy sorting and searching

Event Fields

guidebeginner

For each data record in a repository, each event is parsed into multiple fields for easy sorting and searching
3

Check Search Status

View status information about your search

Check Search Status

guidebeginner

Whenever a repository is searched, status information on that search is displayed in the status bar

Path 2: Change Results Display

The default way in which search results are displayed is usually adequate, especially when first constructing a query. However, you can improve the way the results are displayed.

1

Display Fields

Select which fields to display in query results

Display Fields

guidebeginner

For a more simplified display that is easier to review, you can select which fields to search, which fields in a query results to display - and which to hide
2

Format Columns

Add, eliminate, and reorder field columns in search results

Format Columns

guidebeginner

You can add, eliminate, and reorder the field columns in search results. You can also reformat the contents of those columns for a more meaningful display
3

Filter Highlighting

Highlight search results based on query filters

Filter Highlighting

guidebeginner

Search results can be highlighted based on the filters applied in queries. Highlighting helps you identify where in the event text a query matches the results
4

Change Data Display

Change how data is visualized in search results

Change Data Display

guideintermediate

Search results are ingested as text and, therefore, as default displayed as text. You can change the display for search results to show the data in a variety of ways, including graphs, pie charts, and other graphics
5

Changing Events Display

View events in different display tabs

Changing Events Display

guidebeginner

Events are displayed in the search results in different tabs, depending on the query used

Path 3: Refine Search Results

You can refine search results beyond the initial data display.

1

Selecting Fields

Filter results by selecting specific fields

Selecting Fields

guideintermediate

You can select fields on which to filter the results by excluding or by adding matching fields. You can also configure the formatting of the results
2

Expand Timeframe

Adjust the time interval for search results

Expand Timeframe

guideintermediate

Search results are for a specific time interval: such as, the past day, the past month, other time ranges. Instead of static data, you can also display data for a time interval that includes the current moment, known as live data
3

Set Timezone

Change the time zone for search results

Set Timezone

guideintermediate

Data is ingested into LogScale with a time stamp for each event. Those time stamps are for a specific time zone, but the time zone can be changed in your search results

Path 4: Search Deeper

You can get more information from a search and go deeper into search results without refining or rerunning a search.

1

Inspecting Events

View detailed information about specific events

Inspecting Events

guidebeginner

When you search a repository, you get a list of events in the Event List. You can click a specific event to obtain more details in the Inspection Panel
2

Show Context

View events in context with different time intervals

Show Context

guideintermediate

You can have a detail view in context of a single event and search for value matches with a different time interval
3

Search Interactions

Interact with search results to reveal more information

Search Interactions

guideintermediate

You may find the search results fairly limited. Depending on your user permission, it is possible to interact with the results to reveal much more information
4

Field Interactions

Use contextual menus to perform operations on fields

Field Interactions

guideintermediate

Contextual menus next to fields allows for performing several operations, such as aggregate or filter those fields
5

Field Aliasing

Simplify data correlation with field aliases

Field Aliasing

guideintermediate

Implementing Field Aliasing in your workflow simplifies data correlation from various sources. You can provide alternative names or aliases to fields created at parse time, across a view, or through the entire organization

Path 5: Save and Export Search Results

Search queries can be saved for future use and search results can be exported. There are different saving options and export formats.

1

Saving Searches

Save search queries for future use

Saving Searches

guideintermediate

As it can take some time to construct a search query, saving searches can save time. From the Search interface you can save queries, as well as other assets such as widgets or triggers
2

Data Export

Export search results in various formats

Data Export

guideintermediate

Search results can be exported for use in another application. They can be exported as they are, to a plain text file, or to other formats