You can search in various ways; at a minimum, your search string can contain one or more words, phrases, name=value pairs, or a combination of all.
When you perform a search, search results matching the search query are displayed.
Example
If you search for the word "transaction," you can see all data entries that contain that word.
This topic summarizes the various kinds of search that you can perform to investigate your data.
Related topics
Performing a simple search
You can perform a search by navigating to the Search tab. To perform a search, specify your search criteria in the search bar, and click Search 
. Alternatively, press Enter to execute your search. The search results are displayed on the All Data page. For more information, see Search results.
When you perform a simple search without specifying a time context; by default, you will see search results for the last 60 minutes from your current time.
Searching with a wildcard character
You can perform a wildcard search by specifying the asterisk (*) as a wildcard character. You can use the asterisk to substitute for one or more unspecified characters in your search string.
Example
To search for results containing,
org.springframework.beans.factory.BeanCreationException, enter one of the following strings:org.springframework.beans.factory.BeanCreationException*
BeanCreationExceptionorg.springframework.beans.factory*
Search string syntax
Your search string can contain words, phrases, name=value pairs, fields, tags, and search commands. The accuracy of your search results depends on the syntax used for specifying the search criteria. Depending on your search string syntax, the search results obtained can be generic or specific.
Examples
Specify a search string in the following ways:
- Search string that returns search results containing the exact search string.
- Search string for multiple words that returns search results containing all or only one of the words.
- Search string that uses multiple search commands.
For more information, see Search string syntax.
You might want to search for keywords by providing a particular time frame for your search. Searching with a time context, can be useful when you want to locate events that might have occurred around a particular time frame. Searching with a time context can help you correlate information about events and thus aid your root-cause analysis. You can search for data containing specified search strings that were indexed in the last 15 minutes, 1 hour, 1 day, or 7 days from your current time. You can also search for data by providing a custom time range. The timeline chart appears, showing a summary of your search results, followed by a list of data entries that you can investigate or analyze. Note If you set a custom time for a duration that exceeds the value set in the Read from Past (#days) field when creating data collectors, you might not see any search results. Alternatively, you can adjust the handles on the slider under the timeline chart to select a time range and click Search. This helps you easily select a custom time range and see the corresponding search results. For more information, see Using the timeline and summarization charts.Searching with a time context
To search for key words in a particular time range
:
On selecting this item, on the Select Time dialog box, specify the following information:
and Shift time context to next 
on the top-left of the timeline chart.
The time gap used to browse through the data entries depends on the time range you selected in step 3.
Fields are searchable name=value pairs in the event data that you indexed. When performing a search, you normally search against raw entries of your event data. To make your search more accurate, you can search by using fields. Fields are extracted from the data files at the time of indexing. By default, the HOST and COLLECTOR_NAME fields are displayed on the Filters panel, under the Fields section, on the left. You can also add additional fields under the Fields section and then add those fields to your search criteria. The Filters panel can be collapsed or expanded by clicking Collapse Tags are field values that can be categorized in a certain way; for example, by location, department, operating system, and so on. Tags can be assigned to your event data when you creating a data collector. These tags are displayed under Tags, in the Filters panel on the left, which you can collapse or expand by clicking Collapse You can add fields and tags to your search criteria in various ways to narrow down your results. You can select fields and tags from the Filters panel. You can also click the fields and tags available in the search results area to add it to the search criteria. Additionally, on the Search landing page, when you can click Search Tools, you can select the following default fields or the tags present in the system along with their corresponding value. When you select fields and tags, they are added it to the search criteria. When you add fields or tags to your search criteria, and run the search, your original search query does not change. Instead, the fields and tags are displayed at the bottom of the search bar, where you can choose to include or exclude them, or clear them altogether. To see the actual search query, that is run when you execute a search, click Show Query. Note Searching for a field name=value pair is case sensitive. For more information, see Search string syntax. The following instructions describe the actions supported with performing a search with fields and tags: You can search by using tags in one of the following ways: On the Filters panel, under the Tags section, select one or more tags to add them to the search criteria displayed under the search bar. Under the search bar, you can click IN or NOT IN to toggle between excluding or including fields (or tags) from your search criteria. To remove the field (or tag) from your search criteria, under the search bar, click Remove To clear the fields and tags that you selected to add to your search criteria, under the search bar, click Clear To view the search syntax for the fields and tags included, under the search bar, click View query syntax. Tip You can manually enter field names or tag names in your search criteria. To delete a field from the list of favorites on the Filters panel, under the Fields section on the left, click Remove Note You cannot delete default fields.Searching with fields and tags
or Expand 
. If you are unable to view the field names properly, you can manually drag the Filters panel to get a better view. or Expand . You can narrow your search results by adding tags to your search criteria.
To perform a search by using fields and tags
or Table View 
, click a field from the search results area to add it to your search criteria displayed under the search bar.
On the Chart View 
, click one of field names displayed in the Value column in the table. This action adds the field to the search criteria and also runs the search.
to add the selection to your search criteria. Use this process to add multiple fields to the search criteria.
On the Chart View, click one of tag names displayed in the Value column in the table. This action adds the field to the search criteria and also runs the search.
next to the field (or tag) name.
.To add or delete fields from the list of favorites displayed on the Filters panel
next to the field entry.
next to the field that you want to delete.
Performing an advanced search
Search commands are a set of commands containing arguments that can be run on the output of a particular search. You can chain a set of search commands so that the output of one search command is consumed as the input to the subsequent search command.
You can perform advanced searches by using search commands in your search criteria. In your search criteria, you can add a pipe (|) separator after your original search query, and then specify the search command. Multiple search commands can also be chained by using a pipe separator (|).
For more information, see Search commands.
Running a saved search
Tip You can also execute a saved search by selecting a type-ahead search suggestion while typing the search string the search bar.
.
For more information, see Managing saved searches.
Running a search from an existing dashlet
- Navigate to the appropriate dashboard page available under the Dashboards tab.
Click the chart available in one of the dashlets to run the saved search query associated with the dashlet.
The Search tab displays the search results for the saved search query.Note
This kind of search is not available if the dashlet displays a line chart.
For more information, see Managing dashboards.
Running a search from the type-ahead search suggestions
As you type in the search box, you can see a list of type-ahead suggestions that might be similar to the search query that you are typing. These suggestions include a list of the following items: You can select a suggestion to perform a search with the suggested string as your search query.
Running a search while cross-launching from ProactiveNet (or Infrastructure Management)
On the right side of the window, click Tools Menu Tip You can also cross-launch into IT Data Analytics from an event logged by using IT Data Analytics. To do this, under Event Collectors, navigate to the Details panel of an event, and then click the Show in BMC TrueSight ITDA URL for Object URI.
, select Launch into IT Data Analytics, and then select the host name of the IT Data Analytics server that is registered with BMC ProactiveNet (or Infrastructure Management). You see only those host names that were registered for cross-launch at the time of configuring the ProactiveNet (or Infrastructure Management) server
You can see search results for the search query, HOST="hostName" for 30 minutes before and 30 minutes after the event time.
where, hostName refers to the host name associated with the event.
For more information, see Integrating with ProactiveNet and Infrastructure Management.
Running a search while cross-launching from the TrueSight console
To enable cross-launch from the BMC TrueSight Presentation Server into IT Data Analytics, you must first register details of the IT Data Analytics Server (on the TrueSight console). You can cross-launch into IT Data Analytics from applications and events available on the TrueSight Console.
To cross-launch from the TrueSight console into IT Data Analytics
Access the TrueSight console.
From the navigation menu, navigate to one of the following pages:
Navigate to Click... Monitoring > Applications One of the application names, then click the action menu (vertical three dots) next to the application name, and then select Launch BMC TrueSight IT Data Analytics. Monitoring > Events The action menu next to one of the events that you want to investigate in IT Data Analytics, and then select Launch BMC TrueSight IT Data Analytics. Monitoring > Applications One of the application names, then click the Events tab. Click the action menu next to one of the events that you want to investigate in IT Data Analytics, and then select Launch BMC TrueSight IT Data Analytics. For more information regarding the search queries used while cross-launching, see Integrating with TrueSight Presentation Server.
Continuing a paused search and stopping a search
When you perform a search on the Search tab, after one minute, the search gets automatically paused. When the search is automatically paused, a notification asking whether you want to continue searching or stop (or cancel) the search appears in the search bar. To continue searching and displaying search results, click the Resume link. To stop (or cancel) the search, click the Cancel link in the search bar.
To change the search pause time limit, add the indexing.psJobGetMoreTimeoutInmsec property in the searchserviceCustomConfig.properties file and save the file. This property defines the time limit (in milliseconds) after which the search (including notifications and dashboards) times out. For more information, see Modifying the configuration files.
While your search is still on, you can manually cancel it by clicking Cancel Search 
at the end of the search bar.
Other actions available after performing a search
Use the following options on the Search tab to perform other actions after performing a search:
| Action | Description |
|---|---|
| Export Results | If you want to save the search results for later viewing, you can export them. To do this, click Export Results that is available at the top-right of the search results area. You can export a maximum of 10,000 search results. You can change the maximum number of results to export, by navigating to Administration > System Settings. You can export the results in one of the following formats:
|
| Save Search | If you repeatedly run a particular search, you can save the search query for future use. Furthermore, you can use saved searches for adding dashboards and notifications. To do this, click Save Search For more information, see Managing saved searches. |
Where to go from here
After performing a search, you can perform one or more of the following actions:
- Compare the search results summarized on the timeline chart across different time contexts. For more information, see Comparing results.
- Analyze the pattern in which the search results are occurring for a particular search query. For more information, see Coalescing results.
- Save the search and later use the saved search for adding a dashboard or creating a notification.
Overview
Content Tools
Apps
Reporter Replacement
com.bmc.atlassian.bmc-util-plugin-2.section.label
Tasks