Skip to main content

How to Use the Search Page

On the Search page, you can enter simple or complex queries to search your entire Sumo Logic data repository. You can save and select searches from your Library. After running a search, your results are displayed in either the Messages tab (for raw message data) or the Aggregates tab (for grouped results). See how to navigate through search results.

You can run a saved searchpause, or stop searches, or schedule a search to run periodically and notify you of the results.

search page feb 2022.png

LetterPurpose
ABasic or Advanced mode search text box. Advanced mode searches are limited to a maximum of 15,000 characters in length.

Click the clock icon to see recent searches. Previously run searches are saved automatically for your reference. Instead of recreating your search, you can select it from the dropdown.

As you make changes, a message displays if you have not pressed enter to execute the query: query detected
BTime range of the search.
CStart the search.
DClick the gear icon to open the Search Config menu that has the options to use the receipt time and Auto Parse Mode.
EShare a link for the currently running search.
FSave or schedule a search.
GClick the three-dot icon to open a menu with the following options:
  • Select between Basic or Advanced search mode.
  • Link to search cheat sheets.
  • Edit the search, if it has already been saved.
  • Save or schedule a search.
  • Share a link for the currently running search.
  • Info provides detailed information about the search.
  • Pin the search to run in the background independent of the browser session.
  • Favorite a saved search.
  • Add a new monitor based on the existing query in the search text box.
  • Use Live Tail to see a real-time live feed of log events.
The menu options are dynamically provided so depending on if you have run or saved the search or conducted aggregation some options will be grayed out and unclickable.
HHistogram of the messages.
ISearch Details such as session, status, elapsed time, results, raw count, search expression, and load. When searching an Infrequent Partition the estimated and actual amount of data scanned is displayed.
JSearch results as messages.
KAggregate search results.
LDownload and export search results (up to 100,000 records) as a CSV file.
MChart) options for search results.
NClick the gear icon to open a menu with the options to edit Display Message Preferences, Save as Default View, and Edit Settings JSON.
OAdd to Dashboard allows you to create a panel on a Dashboard from your search. If a Dashboard exists for the Search, you will have another option to Update Dashboard to update it based on changes made here.
PExpands the results table and hides the histogram and search text area.
QHides the histogram.

Query colors explained

In your search query, you'll see that we have separated out important terms in a search for you by color to help you identify them quickly.

Query Sample Colors | Color | Purpose | |:--|:--| | Blue | Boolean operators (and, or, not) | | Red | Quoted string | | Purple | Sumo first operators (parse, nodrop, etc.) and secondary operators (row, column) | | Green | Specific numeric values |

Guide contents

In this section, we'll introduce the following concepts:

icon

Add a Saved Search to Favorites

You can mark a saved search as a favorite so it appears in your Library.

icon

Change the Time Range in the Histogram

Learn how to filter results based on a histogram time range.

icon

Field Browser

Explore specific fields of interest in a search by displaying or hiding selected fields without having to parse them.

icon

Modify a Search from the results table

Modify past searches by selecting text displayed in the Messages tab.

icon

Navigate Messages in Search Results

When you run a search query, messages display in the Message, Aggregates, and Summarize tabs.

icon

Search Highlighting

When your search results are returned, your search terms are highlighted in the Messages tab.

icon

Search Load Indicator

Learn how to reduce system load by making your queries more specific.

icon

Search Modes

Learn about the new search modes of our Log Search page.

icon

Set Messages Tab Preferences

The Preferences menu allows you to customize how messages are displayed.

icon

Wildcards in Full Text Searches

You can use wildcards in full text searches.


tip

Use our Root Cause Explorer to investigate usage and issues.

Legal
Privacy Statement
Terms of Use

Copyright © 2023 by Sumo Logic, Inc.