Perform and save a log search

NXLog Platform provides a comprehensive log analytics interface, allowing you to search logs collected from your NXLog Agent fleet and NXLog Platform audit logs. You can also save your log searches for future use, simplifying recurring log analysis tasks.

Perform a log search

Follow these steps to perform log search:

Depending on the type of logs you are interested in, navigate to:
- Audit logs for platform logs.
- Log Search > Log discovery for your organization logs.
In the Search panel, type your search terms, for example, a hostname, module name, or part of the log message.

Currently, the search applies to the following log fields: Message, Hostname, SourceModuleName and SourceModuleType.

NXLog Platform runs tokenized search with case-insensitive pattern matching.
Click the Search button.
You can further refine the search results by using filters, adjusting the logs timeline, and selecting entries in the Data discovery panel.

Once you are satisfied with the search, you can export the results.

Save a log search

You can save a log search for future use, for example if you will need to run it at regular intervals or it is a complex search to configure.

To save a log search, complete the following steps:

Click the Save this search button.
Enter a Search name.
Refine your optional search settings:
- Share with my organization: Allow other users within your organization to use this search.
- Store selected table columns: Restore the current table columns when loading this search.
- Date and time range: Choose a Relative time range or Absolute time range (default).
Click the Save button.

To reuse a saved log search later on, click the Load saved search dropdown and select the name of the saved search.

Edit or delete a saved log search

You can edit a saved log search, for example to focus or widen the scope of the results or to adjust the search elements to a new context. You can also delete a saved log search you no longer need.

To edit or delete a log search, complete the following steps:

Click the Load saved search dropdown and select the log search you want to edit.
Click Edit search to access the details of the log search.
Edit the relevant log search fields.

Alternatively, click Delete if you want to delete the log search.
To save your changes, either click Save to overwrite the existing saved search or click Save as to save as a new log search.

If you are saving the edited search as a copy, make sure to change the Search name field to avoid confusion later on.