You can search in various ways; at a minimum, your search string can contain one or more words, phrases, name=value pairs, or a combination of all.
When you perform a search, search results matching the search query are displayed.
This topic summarizes the various kinds of search that you can perform to investigate your data.
You can perform a search by navigating to the Search tab. To perform a search, specify your search criteria in the search bar, and click Search Search results.. Alternatively, press Enter to execute your search. The search results are displayed on the All Data page. For more information, see
When you perform a simple search without specifying a time context; by default, you will see search results for the last 60 minutes from your current time.
You can perform a wildcard search by specifying the asterisk (*) as a wildcard character. You can use the asterisk to substitute for one or more unspecified characters in your search string.
org.springframework.beans.factory.BeanCreationException, enter one of the following strings:
Your search string can contain words, phrases, name=value pairs, fields, tags, and search commands. The accuracy of your search results depends on the syntax used for specifying the search criteria. Depending on your search string syntax, the search results obtained can be generic or specific.
Specify a search string in the following ways:
For more information, see.
You might want to search for keywords by providing a particular time frame for your search. Searching with a time context, can be useful when you want to locate events that might have occurred around a particular time frame. Searching with a time context can help you correlate information about events and thus aid your root-cause analysis. You can search for data containing specified search strings that were indexed in the last 15 minutes, 1 hour, 1 day, or 7 days from your current time. You can also search for data by providing a custom time range.
The timeline chart appears, showing a summary of your search results, followed by a list of data entries that you can investigate or analyze.
If you set a custom time for a duration that exceeds the value set in the Read from Past (#days) field when creating data collectors, you might not see any search results.
Alternatively, you can adjust the handles on the slider under the timeline chart to select a time range and click Search. This helps you easily select a custom time range and see the corresponding search results. For more information, see Using the timeline and summarization charts.
are searchable name=value pairs in the event data that you indexed. When performing a search, you normally search against raw entries of your event data. To make your search more accurate, you can search by using fields. Fields are extracted from the data files at the time of indexing. By default, the HOST and COLLECTOR_NAME fields are displayed on the Filters panel, under the Fields section, on the left. You can also add additional fields under the Fields section and then add those fields to your search criteria. The Filters panel can be collapsed or expanded by clicking Collapse or Expand . If you are unable to view the field names properly, you can manually drag the Filters panel to get a better view.
are field values that can be categorized in a certain way; for example, by location, department, operating system, and so on. Tags can be assigned to your event data when you creating a data collector. These tags are displayed under Tags, in the Filters panel on the left, which you can collapse or expand by clicking Collapse or Expand . You can narrow your search results by adding tags to your search criteria.
You can add fields and tags to your search criteria in various ways to narrow down your results. You can select fields and tags from the Filters panel. You can also click the fields and tags available in the search results area to add it to the search criteria. Additionally, on the Search landing page, when you can click Search Tools, you can select the following default fields or the tags present in the system along with their corresponding value. When you select fields and tags, they are added it to the search criteria.
When you add fields or tags to your search criteria, and run the search, your original search query does not change. Instead, the fields and tags are displayed at the bottom of the search bar, where you can choose to include or exclude them, or clear them altogether. To see the actual search query, that is run when you execute a search, click Show Query.
The following instructions describe the actions supported with performing a search with fields and tags:
You can search by using tags in one of the following ways:
On the Filters panel, under the Tags section, select one or more tags to add them to the search criteria displayed under the search bar.
Under the search bar, you can click IN or NOT IN to toggle between excluding or including fields (or tags) from your search criteria.
To remove the field (or tag) from your search criteria, under the search bar, click Removenext to the field (or tag) name.
To clear the fields and tags that you selected to add to your search criteria, under the search bar, click Clear.
To view the search syntax for the fields and tags included, under the search bar, click View query syntax.
You can manually enter field names or tag names in your search criteria.
To delete a field from the list of favorites on the Filters panel, under the Fields section on the left, click Removenext to the field that you want to delete.
You cannot delete default fields.
Search commands are a set of commands containing arguments that can be run on the output of a particular search. You can chain a set of search commands so that the output of one search command is consumed as the input to the subsequent search command.
You can perform advanced searches by using search commands in your search criteria. In your search criteria, you can add a pipe (|) separator after your original search query, and then specify the search command. Multiple search commands can also be chained by using a pipe separator (|).
For more information, see Search commands.
You can also execute a saved search by selecting a type-ahead search suggestion while typing the search string the search bar.
For more information, see Managing saved searches.
Click the chart available in one of the dashlets to run the saved search query associated with the dashlet.
The Search tab displays the search results for the saved search query.
This kind of search is not available if the dashlet displays a line chart.
For more information, see Managing dashboards.
As you type in the search box, you can see a list of type-ahead suggestions that might be similar to the search query that you are typing.
These suggestions include a list of the following items:
You can select a suggestion to perform a search with the suggested string as your search query.
On the right side of the window, click Tools MenuProactiveNet (or Infrastructure Management) server, select Launch into IT Data Analytics, and then select the host name of the IT Data Analytics server that is registered with BMC ProactiveNet (or Infrastructure Management). You see only those host names that were registered for cross-launch at the time of configuring the
HOST="hostName" for 30 minutes before and 30 minutes after the event time.
hostNamerefers to the host name associated with the event.
You can also cross-launch into IT Data Analytics from an event logged by using IT Data Analytics. To do this, under Event Collectors, navigate to the Details panel of an event, and then click the Show in BMC TrueSight ITDA URL for Object URI.
For more information, see Integrating with ProactiveNet and Infrastructure Management.
To enable cross-launch from the BMC TrueSight Presentation Server into IT Data Analytics, you must first register details of the IT Data Analytics Server (on the TrueSight console). You can cross-launch into IT Data Analytics from applications and events available on the TrueSight Console.
Access the TrueSight console.
From the navigation menu, navigate to one of the following pages:
|Monitoring > Applications||One of the application names, then click the action menu (vertical three dots) next to the application name, and then select Launch BMC TrueSight IT Data Analytics.|
|Monitoring > Events||The action menu next to one of the events that you want to investigate in IT Data Analytics, and then select Launch BMC TrueSight IT Data Analytics.|
|Monitoring > Applications||One of the application names, then click the Events tab. Click the action menu next to one of the events that you want to investigate in IT Data Analytics, and then select Launch BMC TrueSight IT Data Analytics.|
For more information regarding the search queries used while cross-launching, see Integrating with TrueSight Presentation Server.
When you perform a search on the Search tab, after one minute, the search gets automatically paused. When the search is automatically paused, a notification asking whether you want to continue searching or stop (or cancel) the search appears in the search bar. To continue searching and displaying search results, click the Resume link. To stop (or cancel) the search, click the Cancel link in the search bar.
To change the search pause time limit, add the
indexing.psJobGetMoreTimeoutInmsec property in the searchserviceCustomConfig.properties file and save the file. This property defines the time limit (in milliseconds) after which the search (including notifications and dashboards) times out. For more information, see Modifying the configuration files.
While your search is still on, you can manually cancel it by clicking Cancel Searchat the end of the search bar.
Use the following options on the Search tab to perform other actions after performing a search:
If you want to save the search results for later viewing, you can export them.
To do this, click Export Results that is available at the top-right of the search results area.
You can export a maximum of 10,000 search results. You can change the maximum number of results to export, by navigating to Administration > System Settings.
You can export the results in one of the following formats:
If you repeatedly run a particular search, you can save the search query for future use. Furthermore, you can use saved searches for adding dashboards and notifications.
To do this, click Save Searchnext to the time range list.
For more information, see Managing saved searches.
After performing a search, you can perform one or more of the following actions: