The saved search feature allows you to save a query statement as a saved search. The feature can make data queries more efficient. This topic describes how to create a saved search in the Log Service console.

Prerequisites

The indexing feature is enabled and indexes are configured. For more information, see Enable and configure the index feature for a Logstore.

Background information

If you need to frequently view the result of a query statement, you can save the query statement as a saved search. You can also use this saved search in alert rules. Log Service periodically executes the saved search and sends alert notifications if the query result meets the preset condition.

Create a saved search

  1. Log on to the Log Service console.
  2. In the Projects section, click a project.
  3. On the Log Management > Logstores tab, choose Management icon > Search & Analysis.
  4. Enter a query statement in the search box, and then click Search & Analyze.
  5. Click Save Search in the upper-right corner of the page.
  6. In the Saved Search Details dialog box, set the parameters. The following table describes the parameters.
    Generate a variable
    Parameter Description
    Saved Search Name The name of the saved search. The name must meet the following requirements:
    • The name can contain lowercase letters, digits, hyphens (-), and underscores (_).
    • The name must start and end with a lowercase letter or digit.
    • The name must be 3 to 63 characters in length.
    Attributes Check the values of the Logstores, Topic, and Query parameters. If the values of the parameters do not meet your requirements, return to the Logstore page, enter a query statement, and then click Save Search again.
    Variable Config Select part of the query statement, and then click Generate Variable. The generated variable is a placeholder variable.
    • Variable Name: the name of the placeholder variable.
    • Default Value: the content that you select from the query statement.
    • Matching Mode: the match mode. You can use the match mode to replace the default value by triggering a drill-down event. Valid values: Global Match and Exact Match.

    For example, when you configure drill-down analysis for a chart, you set Event Behavior to Open Saved Search for the chart, and specify the saved search. The variable of the chart is the same as the Variable Name of the saved search. When you click the chart value, you are redirected to the saved search. At the same time, the Default Value of the placeholder variable is replaced with the chart value that triggers the drill-down event. Then, the new query statement is executed. For more information, see Configure drill-down analysis for a chart of a Logstore.

    Note If you set Event Behavior to Open Saved Search when you configure drill-down analysis for a chart, a saved search must be available and the variables must be configured.
  7. Click OK.

Modify a saved search

  1. Click the Saved search - 002 icon on the left of the search box. In the Saved Search dialog box, click the target saved search.
  2. Enter a new query statement and click Search & Analyze.
  3. Click Modify Saved Search.