• Spaces
  • Collections
  • Help
    • ×
     
     
    •  
    BMC TrueSight IT Data Analytics 2.1

    Page tree

    The Search tab provides you various ways that you can use to filter your data and narrow down your search results. By refining your search criteria, you can find exactly what you are looking for.

    Use the following methods to filter your search results:

    Searching with a time context

    You might want to search for keywords by providing a particular time frame for your search. Searching with a time context, can be useful when you want to locate events that might have occurred around a particular time frame. Searching with a time context can help you correlate information about events and thus aid your root-cause analysis. You can search for data containing specified search strings that were indexed in the last 15 minutes, 1 hour, 1 day, or 7 days from your current time. You can also search for data by providing a custom time range. 

    To search for key words in a particular time range

    1. Click the Search tab.
    2. Enter an appropriate search string in the search bar.
    3. On the time-range list, select one of the following time ranges to apply to your search and click Search :
      • Last 5 minutes: Select this item to search for data (containing the specified search string) that occurred in the last 5 minutes of your current time. 
      • Last 15 minutes: Select this item to search for data (containing the specified search string) that occurred in the last 15 minutes of your current time. 
      • Last 60 minutes: Select this item to search for data (containing the specified search string) that occurred in the last 60 minutes of your current time.
      • Last 6 hours: Select this item to search for data (containing the specified search string) that occurred in the last 6 hours of your current time.
      • Last 24 hours: Select this item to search for data (containing the specified search string) that occurred in the last 24 hours of your current time.
      • Last 2 days: Select this item to search for data (containing the specified search string) that occurred in the last 2 days of your current time.
      • Last 7 days: Select this item to search for data (containing the specified search string) that occurred in the last 7 days of your current time.
      • Custom Time: Select this item if you want to specify a custom time range and search for data (containing the specified search string) that occurred for that particular time frame.
        On selecting this item, on the Select Time dialog box, specify the following information:
        1. From: Click in this field to display a date and time picker and then specify an appropriate date and time to indicate the starting point from where you want to see the data. Click Done.
        2. To: Click in this field to display a date and time picker and then specify an appropriate date and time to indicate the ending point until when you want to see the data. Click Done.
        3. Click OK.

        The timeline chart appears, showing a summary of your search results, followed by a list of data entries that you can investigate or analyze.

        Note

        If you set a custom time for a duration that exceeds the value set in the Read from Past (#days) field when creating data collectors, you might not see any search results.

        Alternatively, you can adjust the handles on the slider under the timeline chart to select a time range and click Search. This helps you easily select a custom time range and see the corresponding search results. For more information, see Using the timeline and summarization charts.

    4. (Optional) Browse through the data entries that appear before and after the time range that you specified, by clicking Shift time context to previous  and Shift time context to next  on the top-left of the timeline chart.
      The time gap used to browse through the data entries depends on the time range you selected in step 3.
    5. (Optional) Right-click on a particular record in the search results, and search for results from the last 5 seconds, 30 seconds, 1 minute, and 5 minutes.
    6. (Optional) Click one of the bars on the timeline chart to drill down into your search results. For more information, see Using the timeline and summarization charts.

    Searching with fields and tags

    Fields are searchable name=value pairs in the event data that you indexed. When performing a search, you normally search against raw entries of your event data. To make your search more accurate, you can search by using fields. Fields are extracted from the data files at the time of indexing. By default, the HOST and COLLECTOR_NAME fields are displayed on the Filters panel, under the Fields section, on the left. You can also add additional fields under the Fields section and then add those fields to your search criteria. The Filters panel can be collapsed or expanded by clicking Collapse  or Expand . If you are unable to view the field names properly, you can manually drag the Filters panel to get a better view.

    Tags are field values that can be categorized in a certain way; for example, by location, department, operating system, and so on. Tags can be assigned to your event data when you creating a data collector. These tags are displayed under Tags, in the Filters panel on the left, which you can collapse or expand by clicking Collapse  or Expand . You can narrow your search results by adding tags to your search criteria.

    You can add fields and tags to your search criteria in various ways to narrow down your results. You can select fields and tags from the Filters panel. You can also click the fields and tags available in the search results area to add it to the search criteria. Additionally, on the Search landing page, when you can click Search Tools, you can select the following default fields or the tags present in the system along with their corresponding value. When you select fields and tags, they are added it to the search criteria.

    • COLLECTOR_NAME
    • DATA_PATTERN

    When you add fields or tags to your search criteria, and run the search, your original search query does not change. Instead, the fields and tags are displayed at the bottom of the search bar, where you can choose to include or exclude them, or clear them altogether. To see the actual search query, that is run when you execute a search, click Show Query.

    The following instructions describe the actions supported with performing a search with fields and tags:

    To perform a search by using fields and tags

    1. Click the Search tab.
    2. Enter an appropriate search string in the search bar and click Search.
    3. Perform one of the following actions:
      • You can search by using fields in one of the following ways:
        • On the Filters panel, under the Fields section, select one or more of the field entries to add them to the search criteria displayed under the search bar.
        • On the Text View  or Table View , click a field from the search results area to add it to your search criteria displayed under the search bar.
          On the Chart View , click one of field names displayed in the Value column in the table. This action adds the field to the search criteria and also runs the search.
        • Click Search Tools next to the time range list, select one of the default fields available in the list under the search bar, select the corresponding value in the adjacent list, and then click Add Filter to add the selection to your search criteria. Use this process to add multiple fields to the search criteria.

      • You can search by using tags in one of the following ways:

        • On the Filters panel, under the Tags section, select one or more tags to add them to the search criteria displayed under the search bar.

        • On the Text View or Table View, add a tag name from the search results area to your search criteria displayed under the search bar.
          On the Chart View, click one of tag names displayed in the Value column in the table. This action adds the field to the search criteria and also runs the search.
        • Click Search Tools next to the time range list, select one of the tags available in the list under the search bar, select the corresponding value in the adjacent list, and then click Add Filter to add the selection to your search criteria. Use this process to add multiple tags to the search criteria.

      Under the search bar, you can click IN or NOT IN to toggle between excluding or including fields (or tags) from your search criteria.

      To remove the field (or tag) from your search criteria, under the search bar, click Remove  next to the field (or tag) name.

      To clear the fields and tags that you selected to add to your search criteria, under the search bar, click Clear .

      To view the search syntax for the fields and tags included, under the search bar, click View query syntax.

      Tip

      You can manually enter field names or tag names in your search criteria.

    4. Click Search to execute your search.

    To add or delete fields from the list of favorites displayed on the Filters panel

    1. On the Search tab, enter a search string in the search bar and click Search.
    2. Perform one of the following actions:
      • To add a field to the list of favorites on the Filters panel, in the search results area, click Add to Fields next to the field entry.

      • To delete a field from the list of favorites on the Filters panel, under the Fields section on the left, click Remove next to the field that you want to delete.

        Note

        You cannot delete default fields.

    Using search operators

    You can also use the various search operators available for filtering data and narrowing down your search results. Search operators are words or symbols that you can add to your search string to narrow down results. For example, && (and), || (or), < (less than), > (greater than), and <> (not equal to).

    For more information, see Search string syntax.

    © Copyright 2005-2023 BMC Software, Inc. Use of this site signifies your acceptance of BMC’s Terms of Use . BMC, the BMC logo, and other BMC marks are assets of BMC Software, Inc. These trademarks are registered and may be registered in the U.S. and in other countries.