Simple Log Service:Saved search

Create a saved search

1. Log on to the Simple Log Service console.

2. In the Projects section, click the one you want.

   

3. On the Log Storage > Logstores tab, click the logstore you want.

   

4. Enter a query statement in the search box and click Last 15 Minutes to specify a query time range.

   For more information, see Step 1: Configure an index.

5. In the upper-right corner of the page, click the icon.

   

6. In the Saved Search Details pane, set the Saved Search Name.

7. Click OK.

   After you create the saved search, you can use it on the Logstore's Search & Analysis page. Click the icon to the left of the search box, and then click the name of your saved search.

Modify a saved search

1. In the navigation pane on the left, choose Resources > Saved Search.

2. In the Saved Search list, click the target saved search.

3. Enter a new query and analysis statement, then click the icon.

4. In the upper-right corner of the page, click the icon.

5. In the Saved Search Details pane, modify the information, then click OK.

Get a saved search ID

After you create a saved search, you can use its saved search ID to embed the saved search page into a custom web page. For more information, see Configure console embedding parameters.

1. In the navigation pane on the left, choose Resources > Saved Search.

2. In the Saved Search list, click the target saved search.

3. Get the saved search ID in the URL in your browser's address bar.

   

Pass variables through URL parameters

You can dynamically substitute variable placeholders in a query and analysis statement by appending parameters to the URL. This method allows you to inject query content when you embed a saved search page in an iframe or link to it from an external system.

Prerequisites

• You have a saved search that uses token variables (placeholders in the ${variableName} format).

• The token feature (tokenQuery mode) is enabled for the saved search.

The standard URL format for a saved search page is as follows:

/lognext/project/{ProjectName}/savedsearch/{SavedSearchName}

You can append query parameters to this URL to dynamically inject variables and add filters. The following table describes the URL parameters.

The token parameter

The token parameter is a JSON array where each element is an object with the format { "key": "variableName", "value": "replacementValue" }:

[{"key": "variableName1", "value": "value1"}, {"key": "variableName2", "value": "value2"}]

For example, assume the query statement for the my-search saved search is * | WHERE status = ${testParam}. Using the following URL updates the query statement to * | WHERE status = '200':

/lognext/project/my-project/savedsearch/my-search?token=[{"key":"testParam","value":"200"}]

The tokenInherit parameter

The tokenInherit parameter has the same format as the token parameter. It is typically used to automatically pass variables when you navigate from a dashboard drill-down, inheriting the selected variable values into the saved search. If both token and tokenInherit are present, variables in token take precedence for the same key.

The filters parameter

The filters parameter is a filter string that is prepended to the query statement with an AND operator. Example:

/lognext/project/my-project/savedsearch/my-search?filters=level%3D"ERROR"

The final executed query statement is:

(level="ERROR") AND <original query statement>

Parameter priority and processing order

If multiple parameters are present, the query statement is constructed in the following order:

1. Starts with the original query statement of the saved search.

2. If token or tokenInherit is present, replaces the ${variableName} placeholders in the statement.

3. If filters is present, adds the filter to the beginning of the statement by using the AND operator.

Complete example

Assume the Project is named my-project and the saved search is named error-query. The query statement is * | WHERE status = ${statusCode} AND host = ${hostName}. You need to pass statusCode=500 and hostName=web-server-01, and add the filter level="ERROR". Construct the URL as follows:

/lognext/project/my-project/savedsearch/error-query?token=[{"key":"statusCode","value":"500"},{"key":"hostName","value":"web-server-01"}]&filters=level%3D"ERROR"

The final executed query statement is:

(level="ERROR") AND * | WHERE status = 500 AND host = web-server-01

Usage in an iframe

When embedding the saved search page in an iframe, you can dynamically construct the src URL with the required parameters:

<iframe
  src="/lognext/project/my-project/savedsearch/error-query?token=[{&quot;key&quot;:&quot;statusCode&quot;,&quot;value&quot;:&quot;500&quot;}]"
  width="100%"
  height="800px"
  frameborder="0"
/>

Alternatively, you can construct the URL dynamically in JavaScript:

const params = encodeURIComponent(JSON.stringify([
  { key: 'statusCode', value: '500' },
  { key: 'hostName', value: 'web-server-01' }
]))

const iframeSrc = `/lognext/project/my-project/savedsearch/error-query?token=${params}`

document.getElementById('sls-iframe').src = iframeSrc

Usage notes

• The value of the token parameter is a JSON array and must be URL-encoded by using encodeURIComponent.

• The variable name (key) must exactly match the token variable names defined in the saved search query statement (case-sensitive).

• If the token feature is not enabled for the saved search (tokenQuery is empty), the token and tokenInherit parameters have no effect, and the query statement is not updated.

• The filters parameter works regardless of whether the token feature is enabled for the saved search.

Delete a saved search

In the navigation pane on the left, choose Resources > Saved Search. In the Saved Search list, hover over the saved search that you want to delete, click the icon, then click Delete.