Review SPL search results

Result tabs

Search result Log Explorer behavior
Raw event search Displays Events.
Transformative search Displays Statistics.
Transformative search with source events Also displays Events.
Compatible numeric or categorical results Also displays Visualization.
Time-series results Selects Visualization by default.

The following image shows raw results in the Events tab.

Figure 1. Raw event results

The Events tab displays a time histogram, fields panel, and logs table for a raw SPL search.

The following image shows transformative results in the Statistics tab.

Figure 2. Statistical results

The Statistics tab displays realm values and counts returned by an SPL stats command.

Supported visualizations

Supported visualizations can include Single Value, Line, Area, Column, Pie, and Table. Log Explorer displays only visualization types that support the returned data shape. The absence of the Visualization tab is expected when the result does not satisfy a supported chart shape.

The following image shows transformative results in the Visualization tab.

Figure 3. Visualized search results

The Visualization tab displays statistical SPL results as a pie chart.