Searching data

In Devo, an event is a single collection of data, just like a record in a log file. All events are assigned tags to identify some key characteristics and to group them into virtual data tables in Devo.

When you run a search in Devo, you specify tags so that it can access the file where events classified with those tags are stored. Each file collects the events of the same data source in rows. Recognized tag combinations have a parser associated that renders the information as a table with rows and columns. The parser assigns data types to each column of the table.

To start searching data, choose Data search in the navigation panel.

The content area of Data search has four tabs.

In the Finders section of the Explore your data tab, you render the desired table by selecting the different levels of tags.

The search area includes options that allow you to narrow the results to only the columns you need; display specific information of the events; or sort and filter the data. You can then start manipulating the data using the wide range of operations available in order to get the required information and build your required query.

For example, you can create additional columns, group the data using a specific period of time, or aggregate the data to apply specific calculations. You can create several paths of operations within a single search, allowing you to access multiple query levels just with one click.

The following articles guide you through the data search process: