Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions blog-service/2026-07-24-search.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
---
title: Filter Search Results from a Column (Search)
image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082
keywords:
- search
- filter
- search results
hide_table_of_contents: true
---

We're excited to introduce the Search Assist Filter, which lets you filter your search results directly from a results-table column instead of manually typing a filter clause into your query. [Learn more](/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab/#filter-results-from-a-column).
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ After running a search, you can make these changes in the **Messages** tab:

* [Add to your search](#add-toyour-search)
* [Parse a field from message text](#parse-a-field-from-message-text)
* [Filter results from a column](#filter-results-from-a-column)
* [Format JSON messages in search results](../search-basics/view-search-results-json-logs.md)

### Add to your search
Expand Down Expand Up @@ -45,6 +46,25 @@ To parse a field from message text:
:::
1. In the **Search** tab, click **Start** to being the search.

### Filter results from a column

You can filter your search results directly from a column in the **Messages** tab instead of typing a filter clause into the query. When you apply a filter, Sumo Logic adds a `where` clause to your query, which you then run to see the narrowed results.

To filter results from a column:

1. Run a search. In the **Messages** tab, click the filter icon in the header of the column you want to filter.<br/><img src={useBaseUrl('img/search/get-started-search/search-page/search-assist-filter.png')} alt="Filter icon and filter panel on a search results column" style={{border: '1px solid gray'}} width="800" />

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I pulled this image from the branch to check it — it's an annotated demo capture with red boxes/arrows labeling "String fields" and "Number fields" over the filter icons. It doesn't actually show the filter panel, operator dropdown, or Top 10 values list that the next two steps describe, so the alt text ("Filter icon and filter panel on a search results column") overstates what's shown. It also has internal host/cluster identifiers visible (e.g. epd_dev1_cluster, org-service-5fc5b766b6-697nz) — matches what you flagged in the PR description. Worth replacing with a masked capture that shows the actual filter panel before publish.

1. Choose an operator and provide a value.
- **String fields**. Select an operator such as **Text contains**, **Text does not contain**, or **Text starts with**, then enter a value. You can also select a value from the **Top 10 values** list, which shows the most common values in the column with their approximate counts.
- **Number fields**. Select an operator such as **Greater than**, **Less than**, or **Equal to**, then enter a value.
Comment on lines +57 to +58

@kimsauce kimsauce Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per the PR notes, these operator lists are phrased "such as" because they reflect only what the demo showed.

1. Click **Apply**. Sumo Logic adds the filter to your query as a `where` clause (for example, `| where _size > 1000`).
1. Click the search button to run the updated query.

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file uses Start everywhere else for running/re-running a query (e.g. two lines up in this same doc: "click Start (or press Enter/Return) to run the appended search"). Suggest matching that here for consistency:

Suggested change
1. Click the search button to run the updated query.
1. Click **Start** (or press Enter/Return) to run the updated query.


:::note
- You can filter on one value at a time. Multi-select is not currently supported.
- When you apply filters on multiple columns, they combine with an `AND`. Contradictory filters return no results.
- Applying a filter returns you to the first page of results.
:::

## Aggregates tab

After running an [aggregate](/docs/search/search-query-language/group-aggregate-operators) search, you can copy values and select from several options to add more operations to your query based on the results in the **Aggregates** tab.
Expand Down
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.