When using the LogScale query language (in parsers, searches or dashboards ) it is important to follow best practices in order to maintain optimum performance and avoid unnecessary system load. Follow the general guidelines provided in Writing Better Queries.

When running a search in LogScale an indicator of the system resources used to run the search is provided by LogScale and shown as Work at the bottom of the search window. (as highlighted in red in below screenshot) This is a useful relative measure of the amount of compute needed to run the search so you can try out different search queries for efficiency.

Figure 73. Query Language