When you run a search your results are provided in a Messages tab. If the search conducted an aggregation you'll also get an Aggregates tab.
The Signatures tab is shown when using LogReduce.
The table columns can be modified by the following:
- Move: Hold click and drag a column from the header row to a different location in the table.
- Hold click and drag the vertical line in between the columns to adjust the width.
- Double click the vertical line to the right of a column name to automatically resize the width to fit the content.
The Aggregates tab allows you to pin columns in the table. When a column is pinned you can scroll to the right and still view it.
- Pin: Hold click and drag a column from the header row to the far left of the table. You'll see a small pin icon when in the correct area to unclick.
Expand and collapse
By default, the Messages tab shows the collapsed version of messages, where the row has a height limit of 500 pixels. Click Expand All on the upper right side of the Messages table to view the full contents of all your log messages.
If expanded, the option changes to Collapse All. Click it to switch back the initial collapsed view.
The Messages tab allows you to right-click a table cell to copy the raw message to your clipboard.
Click anywhere on the table in the Messages or Aggregates tab and you can use the up and down keyboard keys to navigate your results.
If you have many pages of results, you have several options for navigation:
- Scroll down to see more results. The header is static.
- Type a page number into the page number field and hit enter.
- For the Messages tab only, click into a block in the histogram to jump to the page containing the first message from that block. In the default sort order, the message is the most recent message from the block. In a reverse sort order, clicking into the histogram takes you to the page containing the oldest message from that block.
In this example, the largest number of events occurred between 1:56 and 1:57 am. Clicking into the tallest histogram block takes us to the page where logs related to the event can be viewed. This is the page that contains the most recent message from this message block. The note in pink shows the range in time that corresponds to the page you're viewing.