Skip to main content
Sumo Logic

How to Use the Search Page

On the Search page you can enter simple or complex queries to search your entire Sumo Logic data repository. You can save and select searches from your Library. After running a search your results are displayed in either the Messages tab (for raw message data) or the Aggregates tab (for grouped results). See how to navigate through search results.

You can run a saved searchpause, or stop searches, or schedule a search to run periodically and notify you of the results.

search page feb 2022.png

Letter Purpose
A Basic or Advanced mode search text box. Advanced mode searches are limited to a maximum of 15,000 characters in length.

Click the clock icon to see recent searches. Previously run searches are saved automatically for your reference. Instead of recreating your search, you can select it from the drop down.

As you make changes, a message displays if you have not pressed enter to execute the query: 
B Time range of the search.
C Start the search.
D Click the gear icon to open the Search Config menu that has the options to use the receipt time and Auto Parse Mode.
E Share a link for the currently running search.
F Save or schedule a search.
G Click the three-dot icon to open a menu with the following options: The menu options are dynamically provided so depending on if you have run or saved the search or conducted aggregation some options will be grayed out and unclickable.
H Histogram of the messages.
I Search Details such as session, status, elapsed time, results, raw count, search expression, and load.

When searching an Infrequent Partition the estimated and actual amount of data scanned is displayed.
J Search results as messages.
K Aggregate search results.
L Download and export search results (up to 100,000 records) as a CSV file.
M Chart options for search results.
N Click the gear icon to open a menu with the options to edit Display Message Preferences, Save as Default View, and Edit Settings JSON.
O Add to Dashboard allows you to create a panel on a Dashboard from your search. If a Dashboard exists for the Search, you will have another option to Update Dashboard to update it based on changes made here.
P Expands the results table and hides the histogram and search text area.
Q Hides the histogram.

Query colors explained

In your search query, you'll see that we have separated out important terms in a search for you by color to help you identify them quickly.

Query Sample with Colors

Color Purpose
Blue Boolean operators (and, or, not)
Red Quoted string
Purple Sumo first operators (parse, nodrop, etc.) and secondary operators (row, column)
Green Specific numeric values