Use the Filter-Out Option

You can use the filter-out option in the visualizations that generate a table of records to filter the log data with the fields available in the log records.

In the visualizations that provide table of records, click the field value to view the filter out options. In the following example, the records with histogram chart has a table of records with the values available for fields like entity, entity type, log source, and host name.

Description of the illustration filter_out_records_with_histogram.png

When you click the field value, the following filter-out options are available:

• Add to Search: The field that you clicked is added to the search query, and the log data is filtered to include the corresponding field in the search. For example, if you click the entity type value Host (Linux) and specify to add it to search, then the previous search query is updated to include 'Entity Type'='Host (Linux)' in the search string.
• Exclude from Search: This excludes the field from the search, and generates a refined result of log records that don't contain the specified field value. For example, if you click the log source value Linux Syslog Logs and specify to exclude it from search, then the previous search query is updated to have 'Log Source'!='Linux Syslog Logs' in the search string. The resultant log data will have only those log records which are not collected from the specified log source.