Logs table view

Using the Logs Table Interface

The Table interface has the following information and affordances:

Features:

1. Filters help you to determine what requires your immediate attention.

To show filters, expand the filters: click the (Show filters) icon in the top left corner of the page.

To hide the filters, click the (Hide filters) icon in the top right corner of the filter panel.

2. The Search logs searchbar enables you to find logs by any attribute value, facet, label, and so on.

The searchbar works with the Query Builder.

Follow these steps to specify the first query, :

1. Aggregation In the (Show) clause of the query, select from the drop-down either show all logs (default), show all fingerprints, or one of the log attributes or labels.

• The aggregate for show all logs and show all fingerprints is (count of). - The aggregate for string and text attributes and labels is (count unique of). - The default aggregate for numerical values and durations is .
  Note that you can change this aggregation to sum, min, max, stddev, stdvar, first, or last.
  2. Grouping In the (by) clause of the query, select from the drop-down the attribute or attributes for grouping query results.
  3. Limit In the (limit to) clause of the query, complete these steps: * Use the first drop-down to specify if you want to examine the top (default) or bottom results. * Use the second drop-down to specify the number of results.
  4. Step size In the (roll up every) clause of the query, specify the size of the time bucket for aggregating query results.

Depending on the overall interval, the drop-down shows a different automatic rollup period, and several longer options. 5. Function Click (Sigma) to add a formula to apply to the results of the query.

3. Advanced Search
   When on, Advanced search enables you to write your own queries using FuseQL directly.

4. Overall interval. The default is Last 5 minutes. Click the drop-down to use the time picker and select the appropriate time interval.

5. Refresh display: click (Refresh) to update the display.

6. To add a query, click (Add Query). When you specify the first filter, you define the first query. Kloudfuse identifies it as query (a) in the interface. You can add additional queries, (b) and others, to your analysis.

7. To add a formula, click (Add Formula).

8. View type selector enables you to specify the search view by selecting one of the following modes:

• ( Logs Search View)
  • ( Logs Fingerprints View)
  • ( Time Series)
  • ( Top List)
  • ( Table)
  • ( Pie Chart)

9. By default, we use the FuseQL Search toggle to search using the FuseQL.

   To use LogQL, use the toggle.

10. Click (Export) icon to add the chart as a panel of a new or existing dashboard.

11. The Table represents the results of the query, summary of top events over the specified duration, and their count.

    If you specify groupings in the by clause of the query, the table reports these counts separately.