The Search tab provides you various ways that you can use to filter your data and narrow down your search results. By refining your search criteria, you can find exactly what you are looking for.
Use the following methods to filter your search results:
You might want to search for keywords by providing a particular time frame for your search. Searching with a time context, can be useful when you want to locate events that might have occurred around a particular time frame. Searching with a time context can help you correlate information about events and thus aid your root-cause analysis. You can search for data containing specified search strings that were indexed in the last 15 minutes, 1 hour, 1 day, or 7 days from your current time. You can also search for data by providing a custom time range.
The timeline chart appears, showing a summary of your search results, followed by a list of data entries that you can investigate or analyze.
Note
If you set a custom time for a duration that exceeds the value set in the Read from Past (#days) field when creating data collectors, you might not see any search results.
Alternatively, you can adjust the handles on the slider under the timeline chart to select a time range and click Search. This helps you easily select a custom time range and see the corresponding search results. For more information, see Using the timeline and summarization charts.
Fields are searchable name=value pairs in the event data that you indexed. When performing a search, you normally search against raw entries of your event data. To make your search more accurate, you can search by using fields. Fields are extracted from the data files at the time of indexing. By default, the HOST and COLLECTOR_NAME fields are displayed on the Filters panel, under the Fields section, on the left. You can also add additional fields under the Fields section and then add those fields to your search criteria. The Filters panel can be collapsed or expanded by clicking Collapse or Expand . If you are unable to view the field names properly, you can manually drag the Filters panel to get a better view.
Tags are field values that can be categorized in a certain way; for example, by location, department, operating system, and so on. Tags can be assigned to your event data when you creating a data collector. These tags are displayed under Tags, in the Filters panel on the left, which you can collapse or expand by clicking Collapse or Expand . You can narrow your search results by adding tags to your search criteria.
You can add fields and tags to your search criteria in various ways to narrow down your results. You can select fields and tags from the Filters panel. You can also click the fields and tags available in the search results area to add it to the search criteria. Additionally, on the Search landing page, when you can click Search Tools, you can select the following default fields or the tags present in the system along with their corresponding value. When you select fields and tags, they are added it to the search criteria.
When you add fields or tags to your search criteria, and run the search, your original search query does not change. Instead, the fields and tags are displayed at the bottom of the search bar, where you can choose to include or exclude them, or clear them altogether. To see the actual search query, that is run when you execute a search, click Show Query.
The following instructions describe the actions supported with performing a search with fields and tags:
You can search by using tags in one of the following ways:
On the Filters panel, under the Tags section, select one or more tags to add them to the search criteria displayed under the search bar.
Under the search bar, you can click IN or NOT IN to toggle between excluding or including fields (or tags) from your search criteria.
To remove the field (or tag) from your search criteria, under the search bar, click Remove
next to the field (or tag) name.To clear the fields and tags that you selected to add to your search criteria, under the search bar, click Clear
.To view the search syntax for the fields and tags included, under the search bar, click View query syntax.
Tip
You can manually enter field names or tag names in your search criteria.
To delete a field from the list of favorites on the Filters panel, under the Fields section on the left, click Remove
next to the field that you want to delete.Note
You cannot delete default fields.
You can also use the various search operators available for filtering data and narrowing down your search results. Search operators are words or symbols that you can add to your search string to narrow down results. For example, &&
(and), ||
(or), <
(less than), >
(greater than), and <>
(not equal to).
For more information, see Search string syntax.