Bloks
To analyze your data faster, you can create different types of Bloks in LogLogic LMI to help you accelerate your search process.
A Blok is a contextual element or filter that fits with other elements to form a search query. Bloks are reusable elements of a query. You can combine many types of Bloks together to create complex queries. Build and save different Bloks that can be used in future searches rather than searching every time by manually typing the same filter.
LogLogic LMI supports the following types of Bloks:
- Filter Bloks: contain filter statements, aggregation rules
- Correlation Bloks: contain correlation rules
- Time Bloks: contain absolute and relative time ranges
You can have one or more filters in a Blok. If you realize that you need to add another filter to the existing Blok, you can add more filters or build another Blok.
You can add new Bloks and modify existing Bloks from the Search tab. Similarly, you can manage all types of Bloks in a central location by clicking the menu.
When entering a Blok name in the Search field, start with the prefix defined for each type of Blok. Content assist can help you by showing all possible values for that type of Blok. The following is a list of prefixes that you can use:
For detailed information on how to create a Blok, see Adding a Blok.