Filter search results on the Log Viewer in Health Log Analytics

Apply filters on the Log Viewer to show only your desired data.

Before you begin

Role required: evt_mgmt_operator, or evt_mgmt_user, or evt_mgmt_admin

About this task

This feature is supported in the Health Log Analytics application, Version 20.0.11 - July 2021, and the Health Log Analytics Viewer application, Version 20.0.4 - July 2021, available from the ServiceNow Store.

Procedure

1. Open the Log Viewer using one of the following methods:
   • Navigate to Workspaces > Service Operations Workspace and select the Log Viewer icon ().
   • While viewing log entries for an alert on the Surrounding logs tab, select Log Viewer.
2. Define and run a search.
   For more information, see Define, save, and share a search of log data in Health Log Analytics.
3. Filter the search results in one of the following ways.

   Option	Description
   Add filters using the fields list	Select the filter icon (). The Selected fields list includes the fields that currently display as columns in the Log Viewer table. By default, the table includes the following columns: Application service, Component, Host, Level, Message, Raw message, and Time. The Available fields list includes all remaining fields that the system has extracted from the log. Select a field in the list. Note: You can search for a specific field using the search option. The top five values the system has found in the records for this field are displayed, along with the percentage of their occurrence. Define a filter for a value in the field. To display only data that contains a value, select Add for it. For example, to set the filter [Level][is][critical], select Add for the value "critical" in the Level field. To create negative filters that exclude data that contains a value, select Exclude for it. For example, to set the filter [Level][is not][critical], select Exclude for the value "critical" in the Level field.
   Add filters from the Log Viewer table	In a column header, select the more actions icon (). In the dialog box, select the operator and specify the filter terms for the field. Select Apply. A filter icon in the column header indicates that a filter applies for this field.

   The applied filter appears at the top of the Filters pane. The total number of applied field value filters in the Filter icon adjusts.

   

4. Optional: Remove a filter in one of the following ways.
   • In the Filters pane:
     1. Locate the filter you want to remove.
     2. Select Remove.
   • In a column header:
     1. Select the more actions icon ().
     2. Select the filter you want to remove.
     3. Select Remove filter.