Search Analysis

The Search Analysis page — the surface a search result is read on, and what the tabs and the action bar actually do.

Where it is

Search Analysis is the Search module: modules/Logdb/Search, reachable as the Search entry in the navigation and referenced from elsewhere as “Search Analysis” or “the search page”. Older documentation named a second route (“Configuration → Analysis & Tools → Search Analytics”); the module the product actually ships is the same Search surface either way.

The page is one component with three result tabs underneath a shared search bar and a summary bar:

search bar (type toggle · query input · time picker · search button)
summary bar (matches · elapsed · search history · save-as · view SPL)
┌──────────────────────────────────────────────────────────────┐
│  [Log] [Pattern] [Visualization]      action bar (right)     │
└──────────────────────────────────────────────────────────────┘
result area — depends on the active tab

Tabs are real routes: /log, /pattern, /visualization. The active tab is derived from the pathname, and a search result can switch it for you (below).

The search bar

The bar has a type toggle on the left: Interactive search and Advanced search.

type	input	query you get
Interactive	filter rows built by picking a repo, adding filter rows, choosing operators	an SPL string generated from the filters (visible via View SPL)
Advanced	a SonQL editor with autocomplete	the text you typed

The toggle carries the engine version — the Advanced tab’s label shows a tooltip with the configured search language version, from the global search settings. The engine itself (search/search2) is per-query, not per-toggle; see interactive-search.md for why you should name it.

The bar also has the time picker and the search button. Autocomplete offers repo names, source types, SPL keywords, and your own past queries from search history. A help link in the editor opens the SPL command overview.

Time range

The picker offers the three usual shapes, defaulting to Last 5 minutes:

Preset — the date_time preset table: Last 5/15/30/60 minutes, Last 3/4/6/12/24 hours, Last 3/7/30 days, Today, Week/month/quarter/year to date, Yesterday, Previous week/month/quarter/year, All time.
Relative — “N units ago”, with the endpoint either Now (realtime) (the window moves as time passes) or Now (fixed) (anchored to the moment you picked it). Units run seconds to years.
Absolute — explicit earliest/latest YYYY-MM-DD HH:mm:ss.

An “only trading day” filter is available in the picker. It needs search2 — on search (search1) it warns and returns unfiltered results (see interactive-search.md).

The range is a parameter of the search, not part of the query text — over the API it travels as startTime/endTime epoch milliseconds (search-sonql-reference.md).

The summary bar

Above the tabs, after a search runs:

matches (on the Log tab) or results (Visualization) — the count, formatted with separators.
elapsed — the job’s took, rendered like 1s500ms (never the 00:00:00.000 clock format).
View search history — opens the /history route, a per-user list of past searches stored in localStorage, clickable to re-run.
Save as — Alert, Dataset, Report, Export task, filtered by your permissions. Interactive search additionally shows View SPL here.
A zero-result hint when there are no matches, unless the job already carried an explanation — a search-time field the engine could not supply produces zero rows and a warning naming the field, and the UI does not second-guess that with “check your time range”.

The tabs

Log — raw events with a timeline and a field sidebar. The default tab.

Pattern — log pattern recognition (log-pattern-recognition.md).

Visualization — the query’s aggregate result rendered as a chart.

Auto-switch. When a search’s command pipeline ends in a transforming command, the backend marks the job isResult and the page jumps to the Visualization tab on its own. It is suppressed only when you came from Visualization to edit the query — a flag set on the tab switch back to Log. export counts as a result for this decision even though it is not a visualization command.

The Log tab

Three regions: the operation bar, the timeline, and (left) the field sidebar next to the event list.

Timeline histogram. A bar chart of event count per time bucket across the range. Clicking a section narrows the search to that sub-range and re-runs it; a bucket interval control (Chart setting) sits in the action bar.

Field sidebar. Extracted fields for the current result set, each with its distinct count. Selecting fields pins them as columns in the event list. Clicking a field opens a field statistics panel:

summary stats when the field is numeric: max, min, avg, distinct;
a TOP 10 table of the field’s values with count and percentage — clicking a value adds it to the query as a filter;
a Report group with “save to report” links, shaped by whether the field is numeric.

On search2 the statistics come from a summary sub-query built from the current search; the sidebar shows the statistics button when the field has a count or the mode is Smart. (interactive-search.md notes the field-summary sub-job endpoint returns the main job’s content for every mode, so that one dimension was not separately measurable.)

Event list. Events newest-first (or oldest-first via a sort toggle in the result header). Four display modes, switchable in the list header:

mode	shows
Data	the raw line, matches highlighted
List	one line per event with key fields
Table	events as rows, fields as columns
JSON	parsed JSON structure

Clicking a word (a field value) inside an event opens a small action menu:

action	does
Add To Search	add `field=value` to the current query as another filter
Context Query	open the surrounding context of that log line
New Search	start a new search with that field=value as the query
Exclude from search	add `field!=value` (or `NOT value`) to the query
Copy	copy the field to the clipboard

The menu also carries any search actions that match the event (see interactive-search.md). The last row of every event has an expander that opens the event’s field/value table.

Operation bar (right of the tab strip):

Live Tail — a link to the Live Tail view seeded with the current query.
Preview — on/off. With preview on (the default), the search returns partial results as it scans; off, it returns once complete.
Limit — how many events to return: Default limit (500), 100, 500, 1000, or Customize. The Search module constructs its condition service with 500 as the default.
Density — comfortable/compact row spacing.
Runner — pause/resume/stop for the running job.
Download — the current job’s results as Raw, JSON, CSV or TSV (a DownloadType enum: log, json, csv, tsv). Disabled until there are results.
Chart setting — the timeline bucket interval.
Mode — Fast Mode / Smart Mode / Verbose Mode.

The action bar is permission-gated: Save-as-* entries appear only if you may create that object type, Download only if you may download search results, and so on.

Search modes on this surface

The mode picker offers Fast Mode, Smart Mode and Verbose Mode. What they actually do is measured in interactive-search.md. Two surface-level facts belong here:

On search2 the mode picker does nothing and, additionally, Detailed is hidden — the picker is built with external={[JobMode.Detailed]} when the query is search2. On search1 all three are offered.
If a query is switched to search2 while set to Detailed, the page coerces it back to Smart rather than running it.

The Pattern tab

Log pattern recognition. Requires search2 and an event-type repo. Covered in full in log-pattern-recognition.md; the surface here is the Pattern tab, which shares the query from the search bar.

The Visualization tab

When the query ends in a transforming command (or you click the tab), the result renders here. The tab is the visualization surface — chart type selection, a fields/stats builder that round-trips to SPL, and download of the result (Raw/JSON/CSV/TSV). It is the components/SDK/Visualization component; chart editing and dashboard integration are the visualization product’s own surface, not part of search.