The execution of a Simple Search displays all events that match the search query.
The following is displayed for each event:
- The timestamp of the event, i.e. the date and time that the event occurred
- The overall severity of the event, which is the severity of the highest problem found in the event (color-coded; high, medium, low, or none) (provided that Analytics is enabled)
- The fields and field values of the event
- The log, server, and applications of the event.
The text that you searched for is highlighted in yellow. In addition, provided that Analytics is enabled (the system default), the font of the searched text, is colored according to its severity. Also, all field values that Analytics analyzes as being problematic, are color-coded in the event, according to their severity.
Severities are color-coded as follows:
- Red – high severity problem
- Orange – medium severity problem
- Yellow – low severity problem
Hovering over any event displays a menu which enables you to open the Analytics of the event, or view the event in the log viewer.
You also have the option to expand/collapse all events, or alternately, to hide/display the Analytics of all events.
Expanding/Collapsing Events
Events that span over more than a single line or are very long, are followed by an Expand Events icon.
XpoSearch enables you to view the detailed information of a single event, or to open at the click of a button, all events that have more than a single line or very long definitions. This feature makes it possible for you to expand an event to trace its cause.
To expand all events:
- In the Events toolbar, click the Expand Events icon.
The entire event information opens. The toolbar icon changes to the Collapse Events icon, enabling you to later close the event information.
To expand a single event:
- At the end of an event that has an Expand Event icon, click the icon.
The detailed information of the event opens. The icon changes to the Collapse Event icon, enabling you to later close the event information.
To collapse all events:
- In the Events toolbar, click the Collapse Events icon.
The detailed information of all events close. The toolbar icon changes to the Expand Events icon, enabling you to later reopen the detailed information of all the events.
To collapse a single event:
- At the end of the event that has a Collapse Event icon, click the icon.
The detailed information of the event closes. The icon changes to the Expand Event icon, enabling you to later reopen the detailed information of the event.
Showing/Hiding Analytics of All Events
By default, while XpoSearch searches for all events that match your search query, it also performs Analytics on all events, color-coding the searched field values according to their severity, displaying the severity of the events, and suggesting additional potentially problematic field values in the events, and color-coding them in the events. At the click of a button, you can hide Analytics results.
To hide Analytics of all events:
- In the Events toolbar, click the Hide Analytics icon.
The severities of the events are not displayed, and problematic field values are not color-coded. The toolbar icon changes to the Show Analytics icon, allowing you to show Analytics at a later time.
To show Analytics of all events:
- In the Events toolbar, click the Show Analytics icon .
The severities of the events are displayed, and problematic field values are color-coded. The toolbar icon changes to the Hide Analytics icon, allowing you to hide Analytics at a later time.
Viewing the Analytics of an Event
You can view the Analytics of any event, provided that Analytics has been enabled during the search.
To view the Analytics of an event:
- Navigate to the page which contains the event for which you want to open the Analytics, and hover over the event.
A menu appears to the right of the event. - In the menu, select Analytics.
The Analytics page for this event opens under the Analytics tab, showing . . See for a detailed explanation of this screen.
Viewing an Event in the Log Viewer
You can view the details of any event in the log viewer. The log viewer displays the same fields as those displayed in the result event, but in an organized tabular format. Also, in the log viewer you can see the events that preceded and followed the selected event, helping you understand what led to the event.
To view an event in the log viewer:
- Navigate to the page which contains the event that you want to view in the log viewer, and hover over the event.
A menu appears to the right of the event. - In the menu, select Log Viewer.
A notification box opens, informing that the system is loading the log. The Export to PDF notification box appears if pop-ups are blocked. If so, click Continue.
The Log Viewer opens under the XpoLog tab, showing . . See for a detailed explanation of this screen.