Save and Share Log Searches

After you create and execute a search query, you can save and share your log searches as a widget for further reuse.

If you’ve created the widget based on a fixed time range, then every time that you open the widget, it will show the results for the time range that you specified in the search. If you’ve created the widget for a relative time range (say the last 7 days), then every time that you open the widget, it will show the up-to-date results as per the time selector (Last 7 days).

Using saved searches, other users can also access the search query.

Save a Search and Add It to a Dashboard

After you've entered a search query and displayed the results in a chart, to save the search as a widget:

  1. Click Save.

  2. Enter the name and description of the widget.

    You can now add this widget to a custom dashboard. See Create Dashboards.

    You can view the number of saved searches in your Oracle Logging Analytics instance from the Configuration page.

    You can also save your search directly to a dashboard. After you've entered a search query and displayed the results in a chart, to save the search to a dashboard:

    1. Click Save.

    2. Click the Add to dashboard check box.

    3. In the Dashboard field, click the down arrow, and select the name of the dashboard to which you want to save the search. If you want to save the search to a new dashboard, then select New Dashboard and enter the name of the new dashboard.

      Click Save.

      You can now access the saved search from the specified dashboard.

  3. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

  4. The administration resources are listed in the left hand navigation pane under Resources. Click Saved Searches.

    In the Saved Searches page, you can view the list of built-in and custom saved searches. The built-in saved searches are represented with gear icons and the custom ones are represented with human icons.

  5. Click the Actions icon Actions icon next to a saved search entry to display the following menu options:

    • View details: Opens the saved search details page. See the next step for the details of the page.

    • View in Log Explorer: Lets you open the saved search in the Oracle Logging Analytics Explorer view.

    • Copy Log Explorer link: You can copy the link to open the query in the Log Explorer. The scope filter context and the time selector settings would also be part of this link.

    • Duplicate: See Use Oracle-Defined Saved Searches.

    • Copy OCID: The OCID of the saved search resource is copied. You can use it to refer to this resource anywhere in Oracle Cloud Infrastructure.

    • Move resource: The Move Resource to a Different Compartment dialog box is displayed. From the options, select the compartment to which you want to move the saved search and click Move Resource.

    • Get Saved Search definition: See Export the Saved Search.

    • Add tags: See Add Tags to Logging Analytics Resources.

    • Delete: Lets you delete a custom saved search. An Oracle-defined search can’t be deleted. In the case of an Oracle-defined search, the Delete option is grayed out (disabled).

  6. In the Saved Searches listing page, click the name of the saved search that you want to open. The Saved Search details page is displayed.

    The saved search information and associated tags are displayed in the details page. You can perform all the saved search actions listed in the previous step here too.

    The Scheduled Tasks sections displays the list and details of the scheduled tasks created for this saved search.

    To create a new scheduled task, click Schedule Task. In the dialog box, enter the details like task name, target service, metric compartment, metric namespace, resource group, metric name, and interval. Alternatively, you can create a scheduled search detection rule by using the Create Detection Rule user interface. To know more about the details you must provide and steps to create the scheduled search detection rule, see Create a Schedule to Automatically Run a Saved Search Query.

Create a Saved Search from an Existing One

To customize a built-in or custom saved search, use the Save As option in the Log Explorer.

  1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Log Explorer.

  2. In the Log Explorer, click Actions Actions menu menu > click Open.

  3. In the Open dialog box, select the saved search that you want to modify and click Open.

  4. Update the search criteria based on your requirement, click Actions Actions menu menu > click Save As.

  5. In the Save Search dialog box, enter a name for the updated search.

  6. Click Save.

The new search now appears in your list of saved searches.

Use Oracle-Defined Saved Searches

Oracle Logging Analytics provides predefined saved searches for important use cases. You can know more about them through the Description column in the Saved Searches page.

Use the Oracle-defined saved searches in the following ways:

  • View the queried data in the Log Explorer.
  • The Oracle-defined saved search is available as a widget that you can add to the dashboard.
  • Create a duplicate of the Oracle-defined saved search to move it to a different compartment, to add tags, or to create a scheduled task for the underlying query. Use the scheduled task to generate alerts for you.

To duplicate an Oracle-defined save search:

  1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

  2. Click Saved Searches from the list of available resources.

    The Saved Searches listing page will show all saved searches available. You can identify an Oracle-defined save search with the value Oracle-defined in the Creation Type column.

  3. Click Actions menu icon actions menu next to the saved search > click Duplicate.

    The Duplicate Search dialog box opens.

  4. Specify the following information for the duplicate saved search that you want to create:

    • Saved Search Compartment: The compartment in which the duplicate of the Oracle-defined save search must be stored.
    • Search Name: The name that the duplicate must be saved with.

    Click Submit.

Export the Saved Search

You can export the saved search in JavaScript Object Notation (JSON) format:

  1. Open the navigation menu and click Observability & Management. Under Logging Analytics, click Administration. The Administration Overview page opens.

    The administration resources are listed in the left hand navigation pane under Resources. Click Saved Searches.

    The Saved Searches page opens.

  2. Click the Actions menu Actions menu icon corresponding to the saved search that you want to export, and click Get Saved Search definition.

    Alternatively, open the saved search details page of the saved search that you want to export. Click Get Saved Search definition.

  3. Download the JSON file with the same name as the saved search. You can optionally specify a different name.