The Search tab provides you various ways that you can use to filter your data and narrow down your search results. By refining your search criteria, you can find exactly what you are looking for.
Use the following methods to filter your search results:
Search results will be much more relevant if you try to focus on the time range during which the error occurred. For example, searching a specific 15-minute time range can yield more meaningful results than searching the last 24 hours. Therefore, it is recommended that you narrow down your search results by providing a more specific time range.
Searching with a time context can also help you correlate information about events and thus aid your root-cause analysis. For example, you can search for data containing specified search strings that were indexed in the last 15 minutes, 1 hour, 1 day, or 7 days from your current time. You can also search for data by providing a custom time range.
The timeline chart appears, showing a summary of your search results, followed by a list of data entries that you can investigate or analyze.
Note
If you set a custom time for a duration that exceeds the value set in the Read from Past (#days) field when creating data collectors, you might not see any search results.
Alternatively, you can adjust the handles on the slider under the timeline chart to select a time range and click Search. This helps you easily select a custom time range and see the corresponding search results. For more information, see Using the timeline and summarization charts.
Fields are searchable name=value pairs in the event data that you indexed. When performing a search, you normally search against raw entries of your event data. To make your search more accurate, you can search by using fields. Fields are extracted from the data files at the time of indexing. By default, the HOST and COLLECTOR_NAME fields are displayed on the Filters panel, under the Fields section, on the left. You can also add additional fields under the Fields section and then add those fields to your search criteria. The Filters panel can be collapsed or expanded by clicking Collapse or Expand . If you are unable to view the field names properly, you can manually drag the Filters panel to get a better view.
Tags are field values that can be categorized in a certain way; for example, by location, department, operating system, and so on. Tags can be assigned to your event data when you creating a data collector. These tags are displayed under Tags, in the Filters panel on the left, which you can collapse or expand by clicking Collapse or Expand . You can narrow your search results by adding tags to your search criteria.
You can add fields and tags to your search criteria in various ways to narrow down your results. You can select fields and tags from the Filters panel. You can also click the fields and tags available in the search results area to add it to the search criteria. Additionally, on the Search landing page, when you can click Search Tools, you can select the following default fields or the tags present in the system along with their corresponding value. When you select fields and tags, they are added it to the search criteria.
When you add fields or tags to your search criteria, and run the search, your original search query does not change. Instead, the fields and tags are displayed at the bottom of the search bar, where you can choose to include or exclude them, or clear them altogether. To see the actual search query, that is run when you execute a search, click Show Query.
Note
By default, field names and tag names are case sensitive. While searching, you cannot control case sensitivity for field names and tag names. However, you can control case sensitivity for field values and tag values. For more information, see Search string syntax.
The following instructions describe the actions supported with performing a search with fields and tags:
You can search by using tags in one of the following ways:
On the Filters panel, under the Tags section, click Add to search criteria
next to the tag values that you want to add to the search criteria (displayed under the search bar).Click CASE or NOT CASE to apply case sensitivity or case insensitivity for field (or tag) values added to the search criteria.
By default, case sensitivity is applied to field (or tag) values when you add them from the search results area or from the Filters panel. CASE indicates that the field (or tag) value is treated in a case-sensitive way, while NOT CASE indicates that the that the field (or tag) value is treated in a case-insensitive way.
Note
By default, all manually added search strings are treated in a case insensitive way. Therefore, field and tag values included in a manually added search string are treated in a case-insensitive way. You can make these values case-sensitive by using the CASE function. For more information, see Case-sensitive search and case-insensitive search.
When you add a field or tag value from the search results area or from the Filters panel, it is assumed that you want to narrow down your search to the particular value selected. Therefore, by default, such field or tag values added to the search criteria (displayed under the search bar) are treated in a case-sensitive way. You can make it case-insensitive by toggling CASE to NOT CASE, under the search bar.
View the search syntax for the fields and tags included under the search bar by clicking View query syntax.
Tip
You can also manually enter field names or tag names in your search criteria.
To delete a field from the list of favorites on the Filters panel, under the Fields section on the left, click Remove
next to the field that you want to delete.Note
You cannot delete default fields.
You can also use the various search operators available for filtering data and narrowing down your search results. Search operators are words or symbols that you can add to your search string to narrow down results. For example, &&
(and), ||
(or), <
(less than), >
(greater than), and <>
(not equal to).
For more information, see Search string syntax.