Page tree

You can use the Search tab to perform the following functions:

  • Analyze the data that you indexed to find out the root cause of an issue.
  • View your search results in a chart to see a summary or identify trends.
  • Perform an in-depth study of the data to learn more about it.

The Search tab also provides you quick access to the following items displayed in four quadrants:

Data Collectors Events indexed over last week

List of all data collectors that recently polled data (successfully) for search (maximum 10).

Click one of the items in the list to run a search query that shows results originating from that data collector.

Displays a graph that plots a line chart showing all events that were indexed in the last week.

To see this graph, you must configure the product to collect the relevant data.

For more information, see Monitoring the product metrics files.

WorkspacesNotifications

The number of recently created workspaces (maximum of 10).

Click one of the items displayed to switch between workspaces.

List of recently created notifications (maximum of 10).

Click one of the items to edit that notification.

To perform a search, on the Search tab, you must specify a search criteria to see results matching those criteria.

You can provide a search string that can consist of:

  • One or more words, phrases, or name=value pairs, or some combination of the three
  • Fields that you can add from the Filter Pane on the left side of your screen
  • Tags that you can add from the Filter Pane on the left side of your screen
  • A pipe (|) separated list of search commands to analyze your data in various ways (for example, limit or broaden your search; group, order, or filter data; perform statistical calculations; and see tabular or graphical outputs)

The search bar offers type-ahead search suggestions based on a history of your search queries to see a predicted listed of suggestions that might match the last few words of the search query you want to type.

The following image displays the Search tab UI controls:

Search tab UI controls

The Search tab UI has various controls that can be summarized at a high level as follows (from left to right):

Note

You can view the various UI controls summarized in the following table only after you specify a search criteria on the search bar.

UI controls on the Search tab

UI controlDescriptionMore information
Search barCan be used to specify your search criterion.

Searching the data

Search commands
Timeline chart Using the Timeline and Summarization charts
Time range listCan be used to specify a time range for your search.Searching with a time-context
Filter pane

Displays a list of fields and tags to add to your search criteria.

Understanding fields and tags
Search results area

Displays a a list of indexed data, depending on your search criteria. You can view your search results as optimized, minimal, expanded minimal, or detailed. You can switch between the Text View that displays the data in the search results and the Chart View that summarizes your search results as a chart.

By default, a maximum of 100 results are displayed on one page. You can change this setting by changing the page size; navigate to Settings > User Settings.

Viewing and understanding the search results
WorkspacesManaging workspaces