Bloks

To analyze your data faster, you can create different types of Bloks in LogLogic LMI to help you accelerate your search process.

A Blok is a contextual element or filter that fits with other elements to form a search query. Bloks are reusable elements of a query. You can combine many types of Bloks together to create complex queries. Build and save different Bloks that can be used in future searches rather than searching every time by manually typing the same filter.

LogLogic LMI supports the following types of Bloks:

• Filter Bloks: contain filter statements, aggregation rules
• Correlation Bloks: contain correlation rules
• Time Bloks: contain absolute and relative time ranges

You can add one or more filters in a Blok. If you realize that you need to add another filter to the existing Blok, you can add more filters or build another Blok.

You can add new Bloks and modify existing Bloks from the Search tab. Similarly, you can manage all types of Bloks in a central location by clicking the Management > Advanced Features > Bloks menu.

When entering a Blok name in the search query field, start with the prefix defined for each type of Blok. Content assist can help you by showing all possible values for that type of Blok. For time Bloks, you can select the Blok in the time range field. The following is a list of prefixes that you can use in the search query field:

• filter.Blok name
• correlation.Blok name

For detailed information on how to create a Blok, see Creating a Blok.

Blok Groups

The Management > Advanced Features > Bloks page displays Bloks in groups. The All Bloks group displays all Bloks.

For information about groups, types of groups, and managing groups, see the Groups section.