Saved searches and export
Save a search with visibility, severity, cache and default time; run it as search.<name>; turn it into a widget or monitor; export results to CSV or PDF, share to Slack, Teams and PagerDuty, and export beyond one million events with a File forwarder.
What you will do: keep the searches your team runs again as named, cached objects, and get results out of the platform in the format the reader needs.
A saved search is the building block of the rest of XpoLog: widgets, monitors and Analytics all run saved searches. Search covers writing a query; this page covers keeping and exporting it.
Save a search
From the Search console run the query, then choose Action > Save Search; or open PortX > Search > Saved Searches and add one there.
| Setting | Effect |
|---|---|
| Name (required), Description, Context | the name is what search.<name> resolves; the context filters a long list |
| Visibility | private (you) or public (all users) |
| Severity | None keeps the search out of Analytics; Low, Medium or High makes it a predefined problem the Analytics engine reports |
| Create Cache and Cached Time Frames | XPLG keeps results for the chosen time frames generated in the background, so the search answers immediately (recommended; shipped in 7.9387) |
| Default Time | the time range used on first execution; blank uses the range in the query panel |
| Collection Policy, Data Generation Frequency | advanced settings (their purpose is not described in the wiki) |
Edit (name, query, time period, description) and delete from the same console.
Run it
- Pick it from the Saved Searches tab of the search options, or type
search.<name>(autocomplete lists the names). The time menu marks the cached time frames. - Extend it:
* in search.<name> | count | group by …. - Use it in a widget (Action > Save Widget, see Dashboards), a monitor (Action > Save Monitor with a schedule and email recipients, see Monitoring) or an AppTag.
Export results
- Export to PDF/CSV from the actions under the query panel; the GUI export stops at 1,000,000 events.
- Events results switch between raw, parsed and table views, with display options per user profile, and export to several formats (7.9387).
- A widget exports to PDF, CSV or Excel and a dashboard to PDF or CSV, on demand or on a schedule by email or to a file with its own retention; a widget or dashboard permalink embeds the result elsewhere.
- The Log Viewer exports a whole log or folder with its configuration, or its data as XML, CSV, tab-delimited or raw; see Log Viewer.
- Larger than one million events: create a File forwarder over the logs, set its frequency to Never, then Replay it over the time range; the files land where the forwarder points, so check the free space first. See Control and route.
- From code: the search API endpoint under Product API and SDK returns the same results.
Share a search
Share Search after a run offers Copy to clipboard (a link that opens the same query on the same time frame), Slack (a message with the link to chosen channels), MS Teams (to chosen rooms) and PagerDuty (an incident in chosen services). The integrations are configured once by an administrator under PortX > Settings > System Settings > Notifications.
Keep the list useful
- Name by question, not by syntax (
payments-5xx-per-url, notstatus>=500). - Give every search that should raise an Analytics problem a severity; leave housekeeping searches at None.
- Cache the searches behind dashboards and monitors; leave ad-hoc ones uncached.
- Saved searches with a context and an AppTag are found by the teams that own the data.
Next: Dashboards
Source: XPLG wiki, pages 1594130361, 1719926847, 1594130364, 1594131005, 1594131007, 1594130366, 1594133555, 1597013954, 1600094946, 1600356313, 1600356309, 1600356315, 1600356317, 2235465801, 1594131441, 1597539357, 1594131292, 1735327763, 1594131648, 1594132634, 1600095206, 1600356345 (https://xpolog.atlassian.net/wiki/spaces/XPOL/pages/1594130361).
