...

• A graphical presentation of matching events over timeDistribution over , with ability to see the distribution of events over the multiple log sources
• The matching log events from all relevant logs

...

XpoSearch returns a graph that shows the distribution of events over time. You can choose how to display the graph and what to show in the graph. You can also view the distribution of the results in a log, zoom in or out of any time slot, and view The graph has drilldown functionality, enabling you to zoom into any timeslot, and perform the same search on that timeslot. It also enables you to click on a bar or line graph to see the source of events and drill down to see the exact events in any log. You can also view the previous or next timeslot.    

...

You have the option of displaying your graph as a bar graph (the default) or a line graph. In the bar graph, a bar appears at each point in time where events were found to match your search query. The height of each bar represents the number of events that occurred at the specific time. A bar does not appear at times when no events matching your search query occurred. A line graph shows how the number of events matching the search query changes changed from one point in time to the next.

...

You have the option of displaying your graph in a split view or a summary view. In the split view, the number of bars or lines in a timeslot is according to the number of logs that were the source of events in that timeslot; each bar or line represents the number of events for each log source of vents. In the summary view, a single bar or line represents all events from all log sources.

To display your graph in split view:

• In the Graph Toolbar, click Image Added.

To display your graph in summary view:

• In the Graph Toolbar, click Image Added.

Viewing Distribution of Results

...

in Logs

You can click any bar in your graph to see the number of matching events that were produced by each log. You can then click any log to open the log viewer under the XpoLog tab. There, you can see a detailed listing of each matching event in the log. This information includes the date and time of the event, thread ID, thread, and message. 

Zooming In/Out of a Timeslot

...

Viewing the Previous/Next Timeslot

You can display a graphical representation of the number of events that meet the search criteria in the previous or next timeslot, directly from the graph.

To display the previous timeslot:

...

Analyzing Search Result Events

The execution of a Simple Search generates all events that match the search query, up to the maximum allowed by the system. A summary panel is displayed above and below the list of events, enabling you to view the summary of the search and to navigate to any page in the search. You can view the analytics of any event, and view the event in a log viewer. You also have a choice of expanding all events to see their stack traces, and disabling analytics of events (which is normally enabled).

Expanding/Collapsing All Events

...

Viewing an Event in the Log Viewer

You can view any event view the details of any event in the log viewer, as well as the events preceding and following the matching event.

To view an event in the log viewer: 

...