-
Notifications
You must be signed in to change notification settings - Fork 247
DOCS-1755 - Document Search Assist Filter #6933
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| --- | ||
| title: Filter Search Results from a Column (Search) | ||
| image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 | ||
| keywords: | ||
| - search | ||
| - filter | ||
| - search results | ||
| hide_table_of_contents: true | ||
| --- | ||
|
|
||
| We're excited to introduce the Search Assist Filter, which lets you filter your search results directly from a results-table column instead of manually typing a filter clause into your query. [Learn more](/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab/#filter-results-from-a-column). |
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -14,6 +14,7 @@ After running a search, you can make these changes in the **Messages** tab: | |||||
|
|
||||||
| * [Add to your search](#add-toyour-search) | ||||||
| * [Parse a field from message text](#parse-a-field-from-message-text) | ||||||
| * [Filter results from a column](#filter-results-from-a-column) | ||||||
| * [Format JSON messages in search results](../search-basics/view-search-results-json-logs.md) | ||||||
|
|
||||||
| ### Add to your search | ||||||
|
|
@@ -45,6 +46,25 @@ To parse a field from message text: | |||||
| ::: | ||||||
| 1. In the **Search** tab, click **Start** to being the search. | ||||||
|
|
||||||
| ### Filter results from a column | ||||||
|
|
||||||
| You can filter your search results directly from a column in the **Messages** tab instead of typing a filter clause into the query. When you apply a filter, Sumo Logic adds a `where` clause to your query, which you then run to see the narrowed results. | ||||||
|
|
||||||
| To filter results from a column: | ||||||
|
|
||||||
| 1. Run a search. In the **Messages** tab, click the filter icon in the header of the column you want to filter.<br/><img src={useBaseUrl('img/search/get-started-search/search-page/search-assist-filter.png')} alt="Filter icon and filter panel on a search results column" style={{border: '1px solid gray'}} width="800" /> | ||||||
| 1. Choose an operator and provide a value. | ||||||
| - **String fields**. Select an operator such as **Text contains**, **Text does not contain**, or **Text starts with**, then enter a value. You can also select a value from the **Top 10 values** list, which shows the most common values in the column with their approximate counts. | ||||||
| - **Number fields**. Select an operator such as **Greater than**, **Less than**, or **Equal to**, then enter a value. | ||||||
|
Comment on lines
+57
to
+58
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Per the PR notes, these operator lists are phrased "such as" because they reflect only what the demo showed. |
||||||
| 1. Click **Apply**. Sumo Logic adds the filter to your query as a `where` clause (for example, `| where _size > 1000`). | ||||||
| 1. Click the search button to run the updated query. | ||||||
|
Collaborator
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This file uses Start everywhere else for running/re-running a query (e.g. two lines up in this same doc: "click Start (or press Enter/Return) to run the appended search"). Suggest matching that here for consistency:
Suggested change
|
||||||
|
|
||||||
| :::note | ||||||
| - You can filter on one value at a time. Multi-select is not currently supported. | ||||||
| - When you apply filters on multiple columns, they combine with an `AND`. Contradictory filters return no results. | ||||||
| - Applying a filter returns you to the first page of results. | ||||||
| ::: | ||||||
|
|
||||||
| ## Aggregates tab | ||||||
|
|
||||||
| After running an [aggregate](/docs/search/search-query-language/group-aggregate-operators) search, you can copy values and select from several options to add more operations to your query based on the results in the **Aggregates** tab. | ||||||
|
|
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I pulled this image from the branch to check it — it's an annotated demo capture with red boxes/arrows labeling "String fields" and "Number fields" over the filter icons. It doesn't actually show the filter panel, operator dropdown, or Top 10 values list that the next two steps describe, so the alt text ("Filter icon and filter panel on a search results column") overstates what's shown. It also has internal host/cluster identifiers visible (e.g.
epd_dev1_cluster,org-service-5fc5b766b6-697nz) — matches what you flagged in the PR description. Worth replacing with a masked capture that shows the actual filter panel before publish.