The Search Query Panel user interface includes the following elements:
Open the Search Options window icon
Clicking this icon displays a window with four links:
It also includes a Close icon for closing the Search Options window.
When typing a query, the auto-complete section opens. The left side provides suggestions on relevant syntax and sources to run the search on. The right side presents Search History and Saved Searches available for selection.
Search Status icon
indicates that the search is in progress; indicates that the search is complete.
|Search Query||Area for typing a simple or complex search query, or for activating a saved search query. This section will dynamically be expanded when long queries are typed.|
|/||Close Augmented Search / Open Augmented Search buttons. |
By default, the Augmented Search Pane is open. Clicking the button closes the pane; clicking the button opens the pane.
Defines the time period during which the search is to be run.
Selectable time periods include:
|Live Search||XpoLog Search provides Live mode search (near real time). The Live mode may be activated by selecting it from the list of time period options. Once selected the graph area will be cleared and a red buttonwill be presented to indicate Live is active. New records which matches the query criteria will be loaded to the screen every few seconds.|
Clicking this button after typing a search into the Search Query commences the search.
Note: The Search button does not have to be clicked after entering a saved search or a search from history into the Search Query, changing the time period, or performing an augmented search from the Augmented Search Pane. In these cases, the search runs automatically.
Simple Search Syntax
The following table summarizes the simple search syntax:
AND – A and B matches events that contain A and B.
OR – A or B matches events that contain A or B.
NOT – A and NOT (B or C) matches events that contain A but not B or C.
Used to get an exact match of a term. Recommended when there is a key word (such as ( ), =, and, or, not, in, *, ?) within a searched term.
Example: "connection(1234) failure" -> returns events with an exact match to connection(1234) failure.
Used to unify a term result or to create precedence within search queries.
a or (b in folder.my_folder) -> searches for events that contain a, or events that contain b in sub folders and logs under the folder my_folder.
|Wildcards||May be placed anywhere in a search term:|
* – *foo, foo*, f*oo, *foo*, *f*o*o* (* represents any characters, 0 or more times)
? – ?oo, fo?, f? o (? represents any character, exactly one time)
|Search in a specific log/folder/application/server|
Searches for a term in a specified log, folder, application, or server.
error in log.my_log -> searches for error only in logs whose name is my_log.
error in app.my* -> searches for error only in logs associated to applications whose name starts with my.
Searches for events that have a specific value in a specific column of the log.
column_name=search_value -> searches for events that have a column named column_name whose value is equal to search_value (relevant only for logs that have a column with that name).
|Regular expression search|
Searches in events for values represented by regular expressions.
regexp:\d+ in log.access -> searches for numbers in events.
|Activate saved search|
Activates a search that you previously saved.
search.search_name -> runs the saved search called search_name.