Search Templates and Packages

Search

You can use LPSM Search to view the log results from various devices and machines connected to the Director setup. It is the consolidated location to look up and monitor the log results of search queries of multiple Fabric-enabled LogPoint instances. You can search for logs using the LogPoint query language.

Search Page

The Search page contains four sections where you can use the Filter text-box to filter the searches performed.

• My Search History lists the recent search queries executed in the LogPoint Search Master. Click a search from the list to automatically add it to the search bar and display the results.

• My Saved Searches lists the saved search queries in the Fabric-enabled LogPoint instances. Click a saved search from the list to automatically add it to the search bar and display the results.

• Search Templates lists the search templates created in the Fabric-enabled LogPoint instances. Clicking a template opens the search template page.

• Vendor Searches lists the search queries provided by the vendor. Click a vendor search query to automatically add it to the search bar and display the results.

Search Bar

You can search for indexed logs of Fabric-enabled LogPoint instances by setting the Query String, Time range, and Search Options.

Query Bar

You can search logs by using a Query String that you enter in the Query Bar.

Query Bar

The query string is a logical combination of words, phrases, or field values. You can enter a simple query string or build a search string to aggregate different values in the search result and display the result in a graphical format.

• Refer to the Search Query Language section for more details about query strings.

• You can write multiple commands into a single query by using the pipeline (|) character.

• You can write queries in multiple lines in the query bar. Press Shift + Enter to add a new line.

Time Range

You can select the Time range and apply it to your search. The default time range is Last 10 minutes. You can also choose a range from the Last x time-range template or select a time range from the Custom range picker for searches. The custom time ranges such as Last 1 hour, Last 6 hours, and Last 7 days are available in the drop-down.

Time Range

Search Options

The Search Options button in the upper-right corner of the Search Bar allows you to select the search options for a search.

Search Option Button

Search Options Panel

Using the Pool, Machine, User, and Repo options, you can search for logs of a specific repo of a Fabric-enabled LogPoint present in a pool.

Pool

LogPoint pool is a collection of Fabric-enabled LogPoint instances. The Pool option populates all the pools created in the LPSM.

Machine

You can associate multiple machines with a LogPoint pool. Once you select the LogPoint pool, the Machine drop-down populates all the Fabric-enabled LogPoint instances linked to the pool.

User

User lists all the LogPoint users of the selected LogPoint. LPSM executes the search on behalf of the selected LogPoint user.

Repo

The repo selector lets you select the repositories to search logs. You can select multiple repositories by clicking the All drop-down. However, for better performance, you are recommended to select only those repos that you require.

Repo Options

Click the Change option to open the Repo Selector panel, which lists all the available repos.

Repo Selector Panel

When you select the Group by - LogPoint option, all repos within the Fabric-enabled LogPoint instances in the Director setup are displayed. Similarly, when you select Group by - Repo option, all the LogPoint instances associated with the repos are displayed.

Click Search Options and select the Pool, Machine, and the Repo to enable the Search button.

Execute Search and Add to Dashboard

Execute Search

1. Select the Search Options and enter a search query in the query bar.

2. Click Search.

Search Result

• After you perform a search, you can drill down the search result by clicking on the content of the results. Refer to the Drilldown section for more details.

• Refer to the Visualization in LogPoint section for details on the Extended Visualization Framework.

• Refer to the Interesting Fields in LogPoint section for details on the Interesting Fields.

Add a Dashboard from a Search Query

You can use the Add Search To Dashboard option to create a dashboard widget from the search query. You can then add this widget to an existing or a new dashboard.

1. Go to the Search page.

2. Select the Search Options and enter a Search Query in the query bar.

3. Click Search.

4. Click the Add Search To drop-down.

5. Click Dashboard.

6. Select a Pool, a Machine, and a LogPoint user.

7. Click Next.

8. Enter all the information.

9. Click Next.

   The panel lists all the available dashboards for the Fabric-enabled LogPoint user selected in Step 1.

10. You can either select the existing dashboard to place the widget or create a new dashboard.

    1. Select the dashboard where you want to place the widget.

    2. Click the Add new dashboard option to add the Widget to a new dashboard. Enter the dashboard name, click OK, and select the newly created dashboard.

       

11. Click Finish.

12. Click Yes.

More Options

The More drop-down lists all the options that can be carried out on the results of a search query.

More Drop-Down

For simple queries, you can use the Permalink and Save Search options only. For aggregated queries, you can use all the options.

Export as CSV

Export as CSV lets you export the search results in the CSV format.

1. Go to the Search page.

2. Enter an aggregated Search Query in the search bar and click Search.

3. Select Export as CSV from the More drop-down.

Export as Excel

Export as Excel lets you export the search results in the Excel format.

1. Go to the Search page.

2. Enter an aggregated Search Query in the search bar and click Search.

   Export as Excel

3. Select Export as Excel from the More drop-down.

Permalink

Permalink gives you a complete URL required to generate the current search. You can share the link with other users in the system to make an exact and similar search.

1. Go to the Search page.

2. Enter a Search Query in the search bar and click Search.

3. Select Permalink from the More drop-down.

Save Search

Save Search lets you save your current search. You can view the Saved Searches in the Search page from the My Saved Searches section.

1. Go to the Search page.

2. Enter a Search Query in the search bar and click Search.

3. Select Save Search from the More drop-down.

4. Enter all the necessary information.

5. Click Submit.

Search Packages

Search Package is a collection of saved search queries within a Fabric-enabled Logpoint. It allows you to save frequently used search queries for future use, eliminating the need to re-enter them manually each time.

My Packages contain all your search packages, whereas vendor specific search packages provided by vendors are listed in Vendor Packages. Additionally, the search packages that other users share are listed in Shared Packages.

Search Packages

Manage Search Packages

Create Search Packages

You can create a search package to save frequently used search queries and use it in the future without typing the search queries explicitly. To create a search package:

1. Go to Settings >> Logpoint Configuration >> Search Packages.

2. Click Add.

3. Select a Pool, a Machine, and a Logpoint User.

4. Enter a Name and a Description.

5. Click Submit.

6. Click Add.

7. Enter a Name and an Identifier for the saved search.

8. Enter a Query. You can convert the URL encoded search string to the Logpoint search query format by clicking Decode.

9. Click Submit.

Push Search Packages

You can move search packages from one Logpoint to another by pushing them. To push a search package:

1. Go to Settings >> Logpoint Configuration >> Search Packages.

2. Select the search packages and click Push.

   

3. Select the Pool, Logpoint, or User where the selected search packages are to be pushed.

4. Click Push.

Push History

You can click the Push History () button to check the push history. The Push History page lists the Push Summary, Status, Date, and Actions of all push attempts.

Click the Retry () icon from Actions to retry the failed push attempt.

Click the Details () icon from Actions to open the Push Detail page.

Edit a Search Package

1. Go to Settings >> Logpoint Configuration >> Search Package.

2. Click the search package to edit.

3. Update the information.

4. Click Submit.

Share Search Packages

1. Go to Settings >> Logpoint Configuration >> Search Packages.

2. Click the Unshared: Click To share icon from Actions of the package you would like to share.

   1. To share multiple search packages, select the packages. Click the More drop-down and select Share Selected To Users.

   2. To share all the search packages, click the More drop-down and select Share All To Users.

You can unshare search packages following the same steps.

Clone Search Packages

You can create a copy of search packages by cloning them. Cloning a search package creates a copy of it which you can edit while keeping the original search package intact To clone a search package:

1. Go to Settings >> Logpoint Configuration >> Search Packages.

2. Click the Clone icon from Actions of the search package.

3. Enter a new Name for the cloned package.

4. Select Replace Existing? to replace an existing template with the same name.

5. Click Clone.

Delete Search Packages

1. Go to Settings >> Logpoint Configuration >> Search Packages.

2. Click the Delete icon from Actions of the search package.

   1. To delete multiple search packages, select the templates. Click the More drop-down and select Delete Selected Templates.

   2. To delete all the search packages, click the More drop-down and select Delete All.

3. Click Yes.

Manage Saved Searches

Saved Searches lists all the search queries saved in a Fabric-enabled Logpoint.

Click the Manage Saved Searches icon from Actions of a search package to view, clone, edit, delete and register the saved searches in the search package.

Manage Saved Searches

Clone Saved Searches

You can create a copy of saved searches by cloning them. Cloning a saved search creates a copy of it which you can edit while keeping the original saved search intact. To clone a saved search:

1. Go to Settings >> Logpoint Configuration >> Search Packages.

2. Click the Manage Saved Searches icon from Actions of the search package.

3. Click the Clone icon from Actions of a saved search.

   1. To clone multiple saved searches, select the respective searches. Click the More drop-down, select Clone Selected Saved Searches, and click Yes.

   2. To clone all the saved searches, click the More drop-down, select Clone All Saved Searches, and click Yes.

4. Enter New Names for the cloned searches.

5. Check the Replace Existing? checkbox to replace an existing package with the same name.

6. Click Clone.

Register to a Public URL

You can register a saved search to a public URL. When you register a search package, a link appears under Public URL which redirects you to the search page with the saved search query. This allows you to browse the search page without being logged in.

If you are using a fabric-enabled Logpoint which is deployed using AMI, to access the public url you must add the domain name as server alias in System Settings. Go to General Settings to know more about configuring general system settings in Logpoint.

1. Go to Settings >> Logpoint Configuration >> Search Packages.

2. Click Manage Saved Searches under Actions of the search package.

3. Select Unregistered: click to register from public api under Actions of a saved search.

   1. To register multiple saved searches from a public API, select the saved searches. Click More drop-down and select Add Selected to Public URL.

   2. To register all the saved searches from a public API, click More drop-down and select Add All to Public URL.

      Registering All Saved Searches

You can unregister a saved search from the public API following the same steps as above.

Search a Saved Search

1. Go to Settings >> Logpoint Configuration >> Search Packages.

2. Click the Manage Saved Searches icon from Actions of the search package.

3. Click the Search icon from Actions of a saved search.

4. Select the Repo from the drop-down.

5. Click Search.

Delete a Saved Search

1. Go to Settings >> Logpoint Configuration >> Search Packages.

2. Click the Manage Saved Searches icon from Actions of the search package.

3. Click the Delete icon from Actions of a saved search.

   1. To delete multiple saved searches, select the searches. Click the More drop-down and select Delete Selected.

   2. To delete all the saved searches, click the More drop-down and select Delete All.

Search Templates

A Search Template lets you store search queries with placeholders. During runtime, you can replace the placeholders defined in the search template with actual keywords. Refer to the Search Templates section in LogPoint for more details.

Using LPSM, you can create, manage, and perform actions on search templates on behalf of the Fabric-enabled LogPoint.

You can create, edit, and perform actions on search templates on LogPoint v6.10.0 and later only. However, you can share a search template to different user groups with Read, Edit, or Full permissions on LogPoint v6.12.0 and later only, and you can push search templates and view push history on LogPoint v7.0.0 and later only.

Add a Search Template

1. Go to Settings >> LogPoint Configuration >> Search Templates.

2. Click Add.

3. Select a Pool, a Machine, and a LogPoint User.

4. Enter a Name and a Description.

5. Enter a basequery name and a query.

   • Use {{ and }} to enclose placeholders in the queries.

   • Click the Plus icon to add new base queries and the Minus icon to remove a field.

6. In the Fields section, enter a Field which is a placeholder used in a base query, a Display Text for the field, and a default Value.

   You can provide multiple values for Field, Display Text, and Value.

7. Click Submit.

Click the ? icon near the top-right corner to get help on the inputs.

Push Search Templates

1. Go to Settings >> LogPoint Configuration >> Search Templates.

2. Select the search templates and click Push.

   

3. Select the Pool, LogPoint, or User where you want to push the selected search templates.

4. Click Push.

5. You can click the Push History button to check the push history.

   The Push History page lists the Push Summary, Status, Date, and Actions of all push attempts.

   • Click the Retry () icon from the Actions column to retry the failed push attempt.

   • Click the Details () icon from the Actions column to open the Push Detail page.

Edit a Search Template

1. Go to Settings >> LogPoint Configuration >> Search Templates.

2. Click the Edit icon from the Actions column of the search template.

3. Update the information.

4. Click Submit.

Share Search Templates

You can share a search template with all the users in the system and give them the read, edit, or full permissions. Any changes made in the search templates are visible to all the shared users.

Each parameter in a shared search template is categorized into three types:

1. Global parameters can be changed only by the users with the Edit or Full permissions. Changes in the global parameters are reflected for all the users using the shared search template. The following parameters are global:

   • The name, description, queries, and field values of the search template.

   • Title and order of tabs, including creation and deletion of tabs.

   • Title, query, dimensions, and positions of widgets, including addition and deletion of widgets.

2. Personalized parameters can be changed by all the users. However, the changes in the personalized parameters are reflected only for the users making the change. The following parameters are personalized:

   • The updatable parameters

   • Selected repos

   • Time range

3. Hybrid parameters can be changed by all the users. If the user changing the parameters has the Edit or Full permissions, the changes are reflected for all the users. However, if the user has only the Read permission, the changes are reflected only for the user making the change. The following parameters are hybrid:

   • Chart types of widgets

   • Legends and legend labels of widgets

   • Trend state of widgets

• If a user with the Edit or Full permissions changes a hybrid parameter, the changes made by all other users are overridden.

• A user with the Full permission can also Share and Delete a shared search template.

To share a search template:

1. Go to Settings >> LogPoint Configuration >> Search Templates.

2. Click the Share Template icon from the Actions column of the search template.

   1. To share multiple search templates, select the search templates. Click the More drop-down and select Share Selected With Other Users.

3. Select the users groups for all the users you want to share the search templates.

4. Select the Read, Edit, or Full permissions for the users.

5. Click Submit.

• If you delete the owner of the search template from the system, LogPoint provides two options:

  • You can delete the search template as well, making it unavailable to all the users.

  • You can re-assign the search template to any other user in the system.

• You can unshare a search template by removing the permissions for all the user groups from the Share Search Template panel.

Clone Search Templates

1. Go to Settings >> LogPoint Configuration >> Search Templates.

2. Click the Clone icon from the Actions column of the search template.

3. Select a LogPoint user from the drop-down.

4. Enter a new Name for the cloned template.

5. Select the Replace Existing? checkbox to replace an existing template with the same name.

6. Click Clone.

Delete Search Templates

1. Go to Settings >> LogPoint Configuration >> Search Templates.

2. Click the Delete icon from the Actions column of the search template.

   1. To delete multiple search templates, select the search templates. Click the More drop-down and select Delete Selected Templates.

   2. To delete all the search templates, click the More drop-down and select Delete All.

3. Click Yes.

View a Search Template

1. Go to Settings >> LogPoint Configuration >> Search Templates.

2. Click the Name of the template you want to view.

   LPSM directs you to the Search Template View where you can access the dashboards of the search template. From the Search Template View, you can perform the following tasks:

Add a Dashboard

1. Click the Plus icon at the top.

2. Enter the Dashboard Name.

3. Click Ok.

You must add at least one dashboard to use the features of the Search Template View.

Manage Widgets

Add a Widget

1. Click Add Widget.

2. Enter a widget Name.

3. Enter a base Query within {{ and }}.

4. Enter a Description and a Time-range for the widget.

5. Click Finish.

Auto Arrange the Widgets

Click Auto Arrange to automatically arrange the widgets in a presentable form.

Stop Widget Update

After clicking Update, the widgets continuously retrieve their respective logs.

Click the Stop button to stop the widgets from retrieving additional logs. Doing this pauses the visualization of all the widgets. You can only see the already received log results.

• The widgets show updated values only after you click the Update button.

• Click Back to redirect to the list view of the search templates.

• The search templates remember the last visualization used on the widgets.

• You can drill-down on the search results from the non-edit mode of the widget of the search templates.

Update the Parameters

1. Enter the new values for the variables in the Update Parameters section.

2. Select Override widget time range to select a time-range. The time-range you provide takes precedence over the one provided for individual widgets.

3. Select the Repos where you want to perform the search.

4. Click Update.