Run SPL Query in Log Explorer

Select a Log Observer Connect connection and indexes that you have permission to query.

When you open an empty SPL workspace from Builder for the first time, Log Explorer initializes the SPL query with the selected Builder indexes. Builder filters do not transfer. Add any required filter logic to the SPL query.

  1. Open the SPL tab in Log Explorer.
  2. Enter a query using the current SPL1 command set.
  3. Select Run search, or select Enter.
  4. Review the progress indicator while the search runs.
  5. Review the available result tabs when the search completes.
Save an SPL query
  1. In Log Explorer, select SPL and enter your query.
  2. Select Save as, then select Save Query.
  3. Enter the requested query details and save the query.

    To use the query later, open Saved Queries and select the query you want to run.

Each execution creates one search job. Log Explorer uses the job to retrieve results, event summaries, field summaries, and time buckets and to display the job's completion percentage and available event count.