Searching data

You can search ingested data such as log files for keywords. Search results are displayed in a timeline and a table format.

1. From the Search workspace , click the New Search or Add Search tab to open a new search table. Enter the search query.
2. Optional: You can filter data source by name, description, host name, log path, or tags or enter * to do a wildcard search. To limit the extent of the search to an individual data sources and any descendant data sources, select a leaf node from the Data Sources tree ().
3. In the Time Filter pane, click the Time Filter list () and select the time period for which you want to search. Select Custom to specify a start time and date, and an end time and date for your search.
4. In the Search field, type the string for which you want to search in the log files. To view distribution information for all logs, in the Search field, type the wildcard character (*).

   To search for a partial string, type an asterisk (*) at the start and end of your search string. For example, to search for strings that contain the phrase hostname, type *hostname*.

   To narrow your search based on a service topology, type the service topology component on which you want to base your search, followed by a colon (:), followed by your search string. For example, service:DayTrader.

5. Click Search. The first search you perform after the IBM® Operations Analytics - Log Analysis processes have been restarted might take longer to complete than subsequent searches.

   The user interface refreshes every 10 seconds. The updated results are displayed in the progress bar.

   Maximum search results: The search returns a maximum of 1000 records by default. This limit applies only to raw searches and not facet queries. This limit can be configured in unitysetup.properties file property: MAX_SEARCH_RESULTS=1000. Do not to use a high value for the MAX_SEARCH_RESULTS parameter. When a large number of results are returned, it degrades search performance.