The search page
The search page is a query box with a time range, and under it what the search returned: a timeline and an event list for events, a grid with a chart above it for statistics. To its left, a panel with three tabs helps find data, pick fields and run earlier searches again.
The panel#
Global Sources shows what every index on the host holds over a window (the last hour,
24 hours or 7 days): every index with its event count, a trend across
the window and when its newest event arrived; expanded, the sourcetypes
in it with their counts and newest events, and the 20 busiest hosts and
sources. The filter box narrows the tree to the names that contain the
text. A click on an index runs index=web; a click on a sourcetype,
host or source adds that term to the search on screen, replacing a term
for the same field (index=* becomes index=web), and runs it, so the
panel is both a map of the data and a way to start a search. The figures
come from GET /api/datasources?hours=24 (1 to 720 hours), which runs
four GROUP BY queries as the search user and keeps the answer for a
minute per window; the refresh button (refresh=1) asks again.
Current Search is about the search on screen. Its first line is
the scope: the index= and sourcetype= terms of the search part and
the range. In this result is the sidebar of an events result: the
selected fields (host, source, sourcetype, index) and the interesting
ones with how many events carry each; a click lists the top values with
their share, and a value adds field=value to the search. The tab
comes to the front when an events result arrives; a statistics result
has no fields here, its columns are the grid's. All fields lists
every field the search's scope carries, whether or not the result shows
it, with a bar for the share of events that have it: the core columns,
then the search-time fields found in the newest 20,000 events of the
scope in the range (so the answer costs the same whatever the index
holds). It follows the query box as you type. A click lists the field's
top values (a value adds field=value to the search), with Add to
table to show it as a column (added to a | table at the end of the
query, or a new one) and Count by for | stats count by field. The
list comes from GET /api/fields?index=web&sourcetype=x&earliest=-24h&latest=now
(index and sourcetype may repeat and take *; none means every
index but the platform's own; field=name lists that field's top ten
values among the sampled events carrying it), kept for a minute per
question.
History lists the searches this account ran from the search page,
newest first, each with its range, when it last ran, what it returned
and, for one run more than once over the same range, how often. A click
runs it again over the same range; the cross on an entry forgets it and
the one at the top forgets them all. Only searches typed here are kept
(a request with "history": true in POST /api/search), not a
dashboard's panels or a script's calls. An account's history is its own:
GET /api/history lists the caller's, DELETE /api/history/{id} and
DELETE /api/history forget one or all, and nobody reads anyone else's
through the API. It is stored as history/<account>.json under the
engine's data directory, 200 entries at most, and goes with the account
when an admin deletes it.
The arrow at the panel's top right hides it; the choice is remembered in the browser.
Result views#
What a search returns decides how it is shown:
- Events, the raw text with its time, host, source, sourcetype and index, expandable to every field. Table next to it shows the same events as a grid of their fields.
- A grid for a result of chosen fields (
| table index, sourcetype, url,| fields) and for every transforming command (stats,timechart,top,chart): row numbers, sortable columns, numbers right-aligned with a bar for their share of the column's largest (in statistics), times in the local zone, empty values dimmed, long values cut with the whole on hover (Wrap shows them in full). A cell of a category column addsfield=valueto the search. - A chart above the grid when the result charts well. A result over
time (
timechart,stats ... by _time) draws as a line by default, with area and column as alternatives; a result by category (stats count by status) draws as columns when it has 60 rows or fewer, with horizontal bars and a pie (the 12 largest and "other") as alternatives. Table hides the chart. A click on a category adds it to the search, on a time bucket zooms the range to it. The chart type chosen stays for the next result that can draw it.
CSV downloads the result as it stands, every row and column.
Not yet#
- Search-time field extraction and lookups in the Global Sources tab, and the fields a sourcetype extracts shown next to it.
- A history shared with a search's saved form (saved searches, TODO.md).
- The grid's column widths and order are not adjustable, and a result shows its first 5,000 rows.