This topic describes how to save a query statement as a saved search in a Logstore. Saved search is a one-click Search/Analytics feature provided by Log Service.

Prerequisites

The index feature of Log Service has been enabled and configured.

Background information

To simplify operations, you can save frequently performed query statements as a saved search. This way, when you need to view the result of a particular query statement next time, you need only to click the name of the saved search on the left side of the search page. You can also apply the saved search condition to alert rules. Log Service periodically runs the query statement and sends an alert notification when a query result meets the trigger condition.

To set Event Action to Open Saved Search when you configure drill-down analysis, you must preset a saved search and set a placeholder in the query statement. For more information, see Configure drill-down analysis for a chart of a Logstore.

Procedure

  1. Log on to the Log Service console, and then click the target project name.
  2. Click the Logstore management icon icon next to the name of the target Logstore and choose Search & Analysis from the shortcut menu.
  3. Enter a query statement in the search bar. Set a time range. Click Search & Analyze.
  4. Click Save Search in the upper-right corner.
    Saved search
  5. Set parameters for the saved search.
    1. Set Saved Search Name.
      • The name can contain only lowercase letters, digits, hyphens (-), and underscores (_).
      • The name must start and end with a lowercase letter or digit.
      • The name must be 3 to 63 characters in length.
    2. Check the values of the Logstore, Topic, and Query parameters.
      If the values of the Logstore and Topic parameters do not meet your requirements, return to the Logstores page to find the right Logstore. Enter the query statement. Click Save Search.
    3. Optional: Select a part of the query statement. Click Generate Variable.
      The generated variable is a placeholder variable. You can set the placeholder name in the Variable Name field. The selected characters are displayed in the Default Value field.
      Note If the drill-down event of a chart is set to jump to the saved search and the chart has the same Variable value as that of the saved search, clicking the chart triggers the jump. The value of the Variable Name parameter for the placeholder variable is replaced with the chart value that triggers the drill-down event. The query statement with the replaced variable is executed. For more information, see Configure drill-down analysis for a chart of a Logstore.
      Generate a variable
  6. Click OK.

What to do next

To modify a saved search, perform the following operations:
Enter a new query statement. Click Search & Analyze to run the statement. Click Modify Saved Search.Modify a saved search