---
sourceDocument: Australia IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# View log data for an alert

# View log data for an alert in Health Log Analytics {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

View a chart of the frequency of anomalous log lines and the associated log data on the Log Viewer.

## Before you begin

Role required: evt_mgmt_operator, or evt_mgmt_admin

## Procedure

1. Open the Log Viewer tab using one of the following methods:
   * Navigate to WorkspacesService Operations Workspace and select the Log Viewer icon (![Log Viewer icon.]()).
   * While viewing log entries for an alert on the Surrounding logs tab, select Log Viewer.
   {#hla-op-logs-log-viewer-sow__choices_q5b_c1x_stb}
2. **Optional:** Personalize the displayed data and how it is presented on the Log Viewer.  
   * [Filter search results on the Log Viewer in Health Log Analytics](https://www.servicenow.com/docs/YHhho2ZwUIn12tzyQMoX5g "Apply filters on the Log Viewer to show only your desired data.") to show only the data you want to view.
   * [Customize the Log Viewer table in Health Log Analytics](https://www.servicenow.com/docs/2qwqcJq7hpYycUk~ZgXjzA "Add or remove columns in the Log viewer table to show only the data you want to view.") by adding or removing columns.

   {#hla-op-logs-log-viewer-sow__ul_msw_lx2_ftb}


   These features are supported in the Health Log Analytics application, Version 20.0.11 - July 2021, and the Health Log Analytics Viewer application, Version 20.0.4 - July 2021, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home).
3. Analyze log-based anomalies and added context to help you achieve faster mean time to repair (MTTR).  
   For example, say you find a log line with errors found in a configuration file. On the Anomaly card, a sudden spike on the chart indicates where the configuration file is generating the errors. You can view additional key-value pairs extracted from the logs on the Meaningful log properties card and find the affected application services and their related service offerings on the Impacted services card. For greater context, you may want to [investigate
   the logs that surround the anomaly](https://www.servicenow.com/docs/mX_12iVn5JTgym9vDKoPtA "When Health Log Analytics identifies an anomaly, viewing the logs that surround the anomaly provides clues about the state of faulting systems. This information can help you narrow down the root cause of an alert."), locate the configuration file, and find the time frame where the issues occurred.
{#hla-op-logs-log-viewer-sow__steps_gd5_54w_stb}

## What to do next

Use additional features on the Log Viewer to refine your search or define alerts.  
* Modify the search query to fine-tune the search and save useful searches. See [Define, save, and share a log data search](https://www.servicenow.com/docs/EfIvw5TWHaNaqJxf9X_ANA "Define, save, and share searches of log data to help determine the causes of Log Analytics alerts.").
* If you discover important relationships in the log data, select Define alert to define the kind of alert that should be triggered by the data. See [Define a custom Log Analytics alert rule in Health Log Analytics](https://www.servicenow.com/docs/Jk8rQDzN~inCPKKlfRwZZg "Define a custom Log Analytics alert rule for log data that might not generate alerts automatically. A custom rule enables you to specify the metric, threshold, and alert properties directly.") for instructions.
{#hla-op-logs-log-viewer-sow__ul_pfd_xy2_ftb}
**Related concepts**   

* [Review alert logs on the Log viewer](https://www.servicenow.com/docs/5c5_griymLoxpOqRTn4AUw "The Log Viewer tab lets you browse the logs for an alert by timestamp or time range, and visualize anomaly frequency within a specific time period. Customizing the displayed data and adjusting time filters enables you to better understand the framework in which the anomaly occurred, helping you find the root cause faster.")

*[\>]: and then