Search results

When you perform a search, search results matching the search criteria specified are displayed. On the Search > All Data page, search results can be viewed in various ways – series of results (Text View), summarized in a chart (Chart View), tabular format (Table View). When you access the product, search results are displayed based on the last accessed view.

Understanding the All Data page

Viewing and understanding search results

To be able to view and analyze your data, you need to perform various kinds of searches. You can perform a search by specifying a simple search string or building a more complex search string to narrow down your results. For more information about searching data, see Search tab.

When you perform a search, the search results and the timeline chart summarizing the search results are displayed on the All Data page. The timeline chart depicts how your search results are distributed over the specified time. For more information, see Using the timeline and summarization charts.

The search results can be viewed in the following ways:

Action	Icon	Description	Additional information
Text View		Displays a series of actual search results.	Understanding the Text View
Chart View		Displays a summary of the search results in the form of various kinds of charts, for example, bar diagram, pie chart, and so on.	Understanding the Chart View
Table View		Displays the search results in a table formed by fields.	Understanding the Table View

Understanding the Text View

The Text View displays the actual search results in the form of a series of indexed data, also known as records or events. Each record comprises the date, time stamp, time zone of the data entry, and multiple rows of data. If the time stamp for a data file is missing, the product automatically assigns a time stamp at the time of indexing. The time stamp assigned depends on the server on which the Indexer is located.

The following rows are displayed for each record (or event):

Action	Description
Change level of detail	You can change the level of detail for the search results by selecting one of the following views under the timeline chart: Detailed View: Displays data and all fields extracted. (Default) Optimized View: Displays data and the default fields. Expanded Minimal View: Displays all data available so that you can see all entries without having to expand any entries. Minimal View: Displays the data available; however, if some entries have an excessive amount of data, you will need to expand the entry to see all of the data.
Change the number of results	By default, you can see up to 100 results of a search. You can move to the next page of results by selecting one of the number ranges from the list at the bottom of your screen.
Change the time context of the results	You can change the time context of the search results in various ways: Under the search bar, click Shift time context to previous or Shift time context to next  to toggle back and forth and see results for the various time contexts. Right-click on a record in the search results area and select one of the options available. Click one of the bars in the timeline chart to drill down results. Select a different time range from the time range list next to the search bar. Adjust the slider handles under the timeline chart to change the time context and see the results arising thereof. For more information, see Filtering your search results.
Add fields or tags to your search criteria from the results	Click the field or tag name appearing in the search results to add it to your search criteria and perform a search. For more information, see Filtering your search results.
Add fields to the Filters panel from the results	Click Add to Fields next to a field to add that field to the Filters panel on the left and under the Fields section. You can use these fields for narrowing down your results. For more information about searching with fields, see Filtering your search results.
Export search results	Click Export Results at the top-right of the search results area to export your search results as a CSV or a RAW file. You can change the maximum number of results to export, by navigating to Administration > System Settings.

Understanding the Chart View

The Chart View displays the summarization chart that summarizes the search results available as a result of running a search. By default, the summarization chart displays a bar diagram summarized on the basis of the default HOST field. You can change the chart type and the field (or tag) name based on which the search results are summarized. For more information, see Using the timeline and summarization charts.

Understanding the Table View

The Table View displays the search results in a table. Each column in the table represents a field. Each row in the table represents the individual records (or events) that are categorized into columns based on these fields. The date and time string is displayed in the Timestamp column, while the original raw data record is displayed under the Raw Value column.

All fields extracted at the time of indexing and all tags relevant to the search results are displayed in the table. You can use the horizontal scroll bar to see all the columns available. You can also control the number of columns that must be displayed by selecting the correct columns (fields and tags) from the Show or hide columns menu.

If your data does not follow a set pattern or if the pattern continuously changes, you might find that some columns have blank values. This means that those values are only available in particular records for which the field was extracted. You need to navigate through the results to find those values.

You can perform the following actions on the search results displayed in the table:

Action	Description
Resize columns	Change the width of a column, by pointing the right side of the column boundary until it becomes a resize cursor , and then dragging the boundary until the column is the width you want.
Expand a raw value entry	Under the Raw Value column, click the down arrow next to the raw data record to expand and see the entire entry.
Add portions of the record (or event) to your search criteria	Add any portion of the record to your search criteria by pointing to that portion and then clicking Add to Search Criteria .
Add fields to the Filters panel from the results	In the column header, next to the field name, click Add to Fields to add that field to the Filters panel on the left, under the Fields section. You can use these fields for narrowing down your results. For more information about searching with fields, see Filtering your search results. Note: You cannot add the Timestamp and Raw Value fields to the Filters panel.
Control the number of columns displayed	Click Show or hide columns and select the columns (field and tag names) that you want to display. The selected column is displayed with a tick mark. To clear the selection, click the columns that must be hidden.

Summary of the actions available on the All Data page

The following table summarizes the All Data page UI controls at a high level.

You can view the various UI controls summarized in the following table only after you perform a search.

UI controls on the All Data page