Page tree

This topic provides the following information about the Search tab.

Related topics

Why search?

You can use the Search tab to perform the following functions:

  • Analyze the data that you indexed to find out the root cause of an issue.
  • View your search results in a chart to see a summary or identify trends.
  • Perform an in-depth study of the data to learn more about it.

How to search?

To perform a search, on the Search tab, you must specify a search criteria and then click Search to see results matching those criteria. The search bar offers type-ahead search suggestions based on a history of your search queries to see a predicted listed of suggestions that might match the last few words of the search query you want to type.

You can provide a search string that can consist of:

  • One or more words, phrases, or name=value pairs, or some combination of the three.
  • Fields and tags that you can add from the Filter Pane on the left side of your screen.
    The Filter Pane is not available on the initial Search landing page; you can see it after an initial search is completed.
  • A pipe (|) separated list of search commands to analyze your data in various ways (for example, limit or broaden your search; group, order, or filter data; perform statistical calculations; and see tabular or graphical outputs)

For more information, see Search string syntax.

Quick access items on the Search tab

The Search tab provides you quick access to the following items displayed in four quadrants:

Data Collectors Data indexed over last week

List of all data collectors that recently polled data (successfully) for search (maximum 10).

Click one of the items in the list to run a search query that shows results originating from that data collector.

Displays a graph that plots a line chart showing the sum of all the records indexed along with the total volume of data (sum of bytes) indexed in the last week.

This graph gives you a high level understanding about the amount of data indexed by the product. It also indicates the kind of data load that the product is handling.

Example: If you see a sudden dip in the record count on a particular day, it might indicate that some data collectors or the Collection Stations (or Collection Agents) are not working.

In this graph, the following apply:

  • X axis represents the date and time for the last seven days.
  • Y axis on the left, represents sum of records indexed per day.
  • Y axis on the right, represents the total volume of data (sum of bytes) indexed per day.

The number of recently created workspaces (maximum of 10).

Click one of the items displayed to switch between workspaces.

List of recently created notifications (maximum of 10).

Click one of the items to edit that notification.

Actions available on the Search tab

The following image displays the Search tab UI controls:

Search tab UI controls

(Click the image to expand it)

The following table summarizes the Search tab UI controls at a high level. You can view the various UI controls summarized in the following table only after you specify a search criteria on the search bar.

UI controls on the Search tab

UI controlDescriptionMore information
Search bar

Can be used to specify your search criterion.

You can also click Pause Search  or Cancel Search next to the search bar, to pause or cancel a search that is taking too long to complete.

You can click Save Search next to the Search bar to save the search query. You can use the resulting saved search to use it for monitoring the results obtained by running the search query. This can be done by adding views or notifications on the basis of the saved search.

Searching the data

Search commands
Managing saved searches
Timeline chart Using the Timeline and Summarization charts
Time range listCan be used to specify a time range for your search.Searching with a time-context
Filter pane

Displays a list of fields and tags to add to your search criteria.

Understanding fields and tags
Search results area

Displays a a list of indexed data, depending on your search criteria.

You can view your search results as optimized, minimal, expanded minimal, or detailed.

You can switch between the Text View  that displays the data in the search results and the Chart View  that summarizes your search results as a chart. By default, a maximum of 100 results are displayed on one page. You can change this setting by changing the page size; navigate to Settings > User Settings.

You can click Export Search Results to export the search results for later viewing. You can change the maximum number of results to export, by navigating to Administration > System Settings.

Viewing and understanding the search results
WorkspacesManaging workspaces