Data

Based on your search query, the retrieved data is displayed in a normalized tabular format, and each event is summarized per row.

You can view data in the following formats:

From the Data panel, you can perform the following tasks:

  • Viewing event count

    The total number of retrieved events is displayed on the upper-right side.

  • Filtering your results

    You can create a filter using the column value and event body text to fine-tune your search results.

    Click to show or hide filters from the Data panel.

  • Adding a new data model

    You can add a new data model from the Data panel. Click located on the upper-right corner of the Data panel to add a new data model. All events that are displayed in the Results tab are copied in the Create Data Model panel. For instructions on how to add a new data model, see Adding a Data Model in Graphical Mode.

    Note: If a search query contains a single data model, then the defined source filter is copied. If there are multiple data models defined in the query, the Create source filter panel does not display any value.

    You can edit custom data models from the Data panel. Click located on the upper-right corner of the Data panel to edit the data model. All events that are displayed in the Results tab are copied in the Create Data Model panel. For instructions on how to update data models, see Editing Data Models.

    Note: The button is only visible when search results are retrieved using custom data models. You cannot edit the system data models and the LogLogic LMI built-in data models from the system.
  • Downloading your results

    You can share your search results with others. Click located on the upper-right corner of the Data panel to download the search results in the CSV format.

  • Creating filtered query as a new search query

    After adding filters on your results, click the icon, located on the upper-right corner of the Data panel, to create a new search query in a new Search tab for the same conditions.

    In the following illustration, a filter condition Body INCLUDES BillingApp is added on the Data panel in the Search1 tab.

    Now if you click the icon in the Search1 tab, a new tab Search 2 opens, showing the conditions in the Search field.