Start a Live Tail session from the Live Tail page or from the Search page.
Start a Live Tail from the Live Tail page
- Go to Search > Live Tail.
- At the prompt, enter the name of the _sourceCategory, _sourceHost, _sourceName, _source, or_collector of the log you want to tail, along with any filters. Use the syntax
_sourceCategory=name. (For more information, see Filter Live Tail.)
- Click Run or press Enter.
The Run button changes to Running, and log messages fill the screen.
Start a Live Tail from the Search page
- On the Search page, in the search box, enter a valid query for a Source Category, Source Host, Source Name, Source, or Collector with filters, if desired. (Live Tail will take everything before the first pipe, but search operators are not supported.)
- Under the search box, click Live Tail.
- The Live Tail page opens, and the Live Tail session starts.
Pause and resume Live Tail
To review details, you can pause the Live Tail using the Pause button, then scroll up or down using your mouse. (You can also simply scroll up to pause.) The Live Tail continues to run, but the screen no longer automatically scrolls. The Pause button changes to an arrow Jump to Bottom button. To resume automatic scrolling, just click the arrow button, or click Jump to Bottom at the bottom of the screen, which will jump you to the bottom of the log messages.
To pause Live Tail:
- Click the Pause button, or simply scroll up using your mouse.
The Pause button changes to an arrow Jump to Bottom button. The Live Tail is still running, but automatic scrolling on your screen stops.
- Scroll up or down using your mouse to review log message details.
Change a Live Tail query
If you change the query at any time, the Running button changes back to Run. When you click Run or press Enter, it stops the previous Live Tail, and starts a new one with the new query.
Stop Live Tail
- Click the details icon and then choose Stop Live Tail.
- The screen is cleared and the Live Tail is stopped.