{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"40a1a482-69e1-4151-925c-90e139f3205f"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"57ec9863-9bd2-4743-9403-6e4eb396e6da"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"What permissions do I need to perform a global search?","type":"text"}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"paragraph","content":[{"text":"In order to access this area to perform a global search (","type":"text"},{"text":"Data Search → Explore Your Data → Global Search tab","type":"text","marks":[{"type":"strong"}]},{"text":"), you need to have a role with management permissions on ","type":"text"},{"text":"Global Searches ","type":"text","marks":[{"type":"strong"}]},{"text":"(","type":"text"},{"text":"Administration","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Roles","type":"text","marks":[{"type":"strong"}]},{"text":" → ","type":"text"},{"text":"Permissions","type":"text","marks":[{"type":"strong"}]},{"text":" tab).","type":"text"}]},{"type":"paragraph","content":[{"text":"If you do not have this permission, you will not be able to see the tab and hence perform any global search.","type":"text"}]},{"type":"paragraph","content":[{"text":"Be aware that this permission requires to have management permissions on ","type":"text"},{"text":"Finders","type":"text","marks":[{"type":"strong"}]},{"text":" to be activated.","type":"text"}]}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"mediaSingle","attrs":{"layout":"center","width":80.0},"content":[{"type":"media","attrs":{"width":472,"id":"4ec03261-2fc2-477a-90cd-ae35a29892b3","collection":"contentId-94742606","type":"file","height":251}}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Domain feature","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that this feature is only enabled in certain domains by default so even though you have the required permissions, you might still be unable to see it. If you need to use it and is not enabled in your domain, contact the ","type":"text"},{"text":"Devo support team","type":"text","marks":[{"type":"link","attrs":{"href":"mailto:support@devo.com"}}]},{"text":".","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Using the global search","type":"text"}]},{"type":"paragraph","content":[{"text":"Users with the necessary permissions can run a global search in Devo to find events containing specific values across all the data tables in their current domain.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":65.0},"content":[{"type":"media","attrs":{"width":1425,"id":"00a24cf7-e880-4a45-8153-ae1015c0e083","collection":"contentId-94742606","type":"file","height":707}}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Go to ","type":"text"},{"text":"Data search ","type":"text","marks":[{"type":"strong"}]},{"text":"and select the ","type":"text"},{"text":"Global search","type":"text","marks":[{"type":"strong"}]},{"text":" tab.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Click to open the time menu and select the time period over which you want to search (see the ","type":"text"},{"text":"section below","type":"text","marks":[{"type":"link","attrs":{"href":"#time_range_global_search"}}]},{"text":" for more info).","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select the tables that you wish to search. Note that, by default, all tables are selected, and switching off one of them will switch off the ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"Select all tables","type":"text","marks":[{"type":"strong"}]},{"text":" option.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enter the expression you want to search for. You can use standard ","type":"text"},{"text":"AND","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"OR","type":"text","marks":[{"type":"em"}]},{"text":" operators, use an asterisk ( * ) as a wildcard, or quotation marks ( \"\" ) to indicate exact expressions. For example: ","type":"text"},{"text":"user1@domain.com","type":"text","marks":[{"type":"em"}]},{"text":"OR","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":"user2@domain.com","type":"text","marks":[{"type":"em"}]},{"text":"AND\"","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":"illegal access","type":"text","marks":[{"type":"em"}]},{"text":"\"AND*","type":"text","marks":[{"type":"strong"},{"type":"em"}]},{"text":"apache","type":"text","marks":[{"type":"em"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Hit the ","type":"text"},{"type":"status","attrs":{"color":"neutral","style":"bold","text":"ENTER","localId":"aa6341c9-5b48-43cf-b2a2-9e755d84d1b3"}},{"text":" key to run the search.","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Activity shown","type":"text"}]},{"type":"paragraph","content":[{"text":"In order to avoid long loading times, note that the global search only returns events from data tables that had some activity for the last 7 days.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"type":"inlineExtension","attrs":{"extensionType":"com.atlassian.confluence.macro.core","extensionKey":"anchor","parameters":{"macroParams":{"":{"value":"time_range_global_search"}},"macroMetadata":{"macroId":{"value":"4ab4402f-d8db-43b1-8770-47d0b980f1b8"},"schemaVersion":{"value":"1"},"title":"Anchor"}},"localId":"b0c22694-0df2-4bdf-9f4c-d0b756db0b06"}},{"text":"Setting time ranges for a global search","type":"text"}]},{"type":"paragraph","content":[{"text":"When setting time ranges, it is important to consider different aspects related to the type of time range specified and the method chosen to do it. You can use the interface to set ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"absolute","type":"text","marks":[{"type":"strong"}]},{"text":", ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"relative","type":"text","marks":[{"type":"strong"}]},{"text":",","type":"text"},{"text":" or ","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]},{"text":"snap-to","type":"text","marks":[{"type":"strong"}]},{"text":" dates:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Absolute","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}},{"type":"strong"}]},{"text":": a specific interval with fixed start and end dates to see data from a specific time period.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Relative","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}},{"type":"strong"}]},{"text":": a period of time relative to the current date (last 5 minutes, last day, etc.) to see data progression up to the present.","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Snap to","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}},{"type":"strong"}]},{"text":": a period of time that goes back to the starting point of the selected time frame to see data without unrepresentative data samples resulting from analyzing incomplete periods. For example, if it is 10:53:17 on a Tuesday:","type":"text","marks":[{"type":"textColor","attrs":{"color":"#172b4d"}}]}]}]}]},{"type":"paragraph","marks":[{"type":"indentation","attrs":{"level":3}}],"content":[{"text":"Snap to the day: you will see data beginning at 00:00 on that same Tuesday.","type":"text"},{"type":"hardBreak"},{"text":"Snap to the hour: you will see data beginning at 10:00.","type":"text"},{"type":"hardBreak"},{"text":"Snap to the minute: you will see data beginning at 10:53:00.","type":"text"}]},{"type":"paragraph","content":[{"text":"You can set a time range using the interface or manually introduce time expressions. Select the corresponding tab below to see the desired method.","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-expands-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"4d1d4a95-e191-4ec8-8c2d-189ac087af95"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/expand.png"}}],"title":"UI Expands"}},"localId":"c4d2bd2e-7ac7-4d5b-b1f1-57d3f62358c6"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-expand","parameters":{"macroParams":{"title":{"value":"Using the interface"}},"macroMetadata":{"macroId":{"value":"0d4bbe12cfd8284ae545f082602d80f9"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/expand.png"}}],"title":"UI Expand"}},"localId":"5917dd4c-8d93-48d9-a380-b5f45ff9e96e"}},{"type":"paragraph","content":[{"text":"You can set a time interval following the steps described in the picture below.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":50.0},"content":[{"type":"media","attrs":{"width":766,"id":"2866be38-0d91-437f-869c-fc0f0566ff36","collection":"contentId-94742606","type":"file","height":212}}]},{"type":"paragraph"},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-expand","parameters":{"macroParams":{"title":{"value":"Using date language expressions"}},"macroMetadata":{"macroId":{"value":"308335090a8e77f4228f548c924430c9"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://d1bgdtsfe1sjdg.cloudfront.net/refinedtheme-for-cloud/macro-icons/expand.png"}}],"title":"UI Expand"}},"localId":"d419d88a-9cb7-41a0-86b8-2cfef9119360"}},{"type":"paragraph","content":[{"text":"Y can also introduce time ranges manually using ","type":"text"},{"text":"date language expressions","type":"text","marks":[{"type":"strong"}]},{"text":", which gives you more flexibility and precision when searching your data. Simply click on the date field and write the desired time expression or edit the existing one. The field turns red and an explanatory message appears until a valid date is entered. Click ","type":"text"},{"text":"Apply","type":"text","marks":[{"type":"strong"}]},{"text":" when you finish. When the and the expressions will be translated into the corresponding dates.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Invalid expressions","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Your ","type":"text"},{"text":"from","type":"text","marks":[{"type":"strong"}]},{"text":" date cannot be after your ","type":"text"},{"text":"to","type":"text","marks":[{"type":"strong"}]},{"text":" date and your ","type":"text"},{"text":"to","type":"text","marks":[{"type":"strong"}]},{"text":" date cannot be in the future.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"You can use a mix of both absolute and date language expressions in any given time range (for example, the ","type":"text"},{"text":"to","type":"text","marks":[{"type":"strong"}]},{"text":" date can be relative and the ","type":"text"},{"text":"from","type":"text","marks":[{"type":"strong"}]},{"text":" date absolute, and vice versa). For date language expressions, the current moment \"now()\" is used as the reference point.","type":"text"}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Operators","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"You can establish absolute dates in the required format:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"fddbaca1-315a-4898-8386-c9dab5eacf50"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Operator","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Action","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"yyyy-MM-dd hh:mm:ss","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Establishes the specified absolute date","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"2021-06-30 15:35:23","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"With date language expressions, use a series of mathematical operations to move away from the current time which is used as the reference point. You can use multiple operators at once and the execution order is from left to right:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"2d0e09ff-6026-4b5e-ae04-332f01a37b00"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Operator","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Action","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Example","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Snap to (@) or |<","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Rounds the date to the beginning of a time unit. Note that this operator only works with 1m, 1d, 1h, 1w, 1W, 1M and 1y.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() @ 1m or now() |< 1m","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Arithmetics (+/-)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Applies an offset to the date (date + offset or date - offset)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() - 3h","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Replace (^)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Replaces part of the date by a time unit (date ^ time_unit)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() ^ 6d","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Backward & forward (>>/<<)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Shifts the date to the next/past time unit (date >> time_unit or date << time_unit)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() << 11M","type":"text"}]}]}]}]},{"type":"rule"},{"type":"paragraph","content":[{"text":"Time expressions","type":"text","marks":[{"type":"strong"}]}]},{"type":"paragraph","content":[{"text":"Let's suppose the current time (which we refer to as \"now()\") is ","type":"text"},{"text":"Sunday, 05 February 2017, 13:37:05. ","type":"text","marks":[{"type":"strong"}]},{"text":"The table below shows the resulting time when different expressions are applied. Note that this isn't an exhaustive list:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"f5ded291-a690-41f2-9a85-43a01cd7283b"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Time expression","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Resulting time","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() - 60m","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"60 minutes ago","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Sunday, 05 February 2017, ","type":"text"},{"text":"12","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":":37:05","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() @ 1h","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Now (rounded to the beginning of the hour)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Sunday, 05 February 2017, 13:","type":"text"},{"text":"00:00","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() - 24h","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"24 hours ago","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Saturday, ","type":"text"},{"text":"04","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":" February 2017, 13:37:05","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"(now() - 1d) @ 1d","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Yesterday (rounded to the beginning of the ","type":"text"},{"text":"day","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Saturday, ","type":"text"},{"text":"04","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":" February 2017, ","type":"text"},{"text":"00:00:00","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"(now() - 2d) @ 1d","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"2 days ago (rounded to the beginning of the ","type":"text"},{"text":"day","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Friday, ","type":"text"},{"text":"03","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":" February 2017, ","type":"text"},{"text":"00:00:00","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"(now() - 2d) @ 1m","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"2 days ago (rounded to the beginning of the ","type":"text"},{"text":"minute","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Friday, ","type":"text"},{"text":"03","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":" February 2017, 13:37:","type":"text"},{"text":"00","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"((now() - 2d) @ 1d) - 2h","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"2 days ago (rounded to the beginning of the ","type":"text"},{"text":"day minus 2 hours","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Thursday, ","type":"text"},{"text":"02","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":" February 2017, ","type":"text"},{"text":"22:00:00","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() @ 1w","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Locale week","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Sunday","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":", 05 February 2017, ","type":"text"},{"text":"00:00:00","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() @ 1W","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"ISO week","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Monday","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":", ","type":"text"},{"text":"30 January","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":" 2017, ","type":"text"},{"text":"00:00:00","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() ^ 6d","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Replace the day with 6","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Monday, 06","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":" February 2017, 13:37:05","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() ^ 2018y3M6d15h30m20s","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Replaces the year with 2018","type":"text"},{"type":"hardBreak"},{"text":"Replaces the month with 3","type":"text"},{"type":"hardBreak"},{"text":"Replaces the day with 6","type":"text"},{"type":"hardBreak"},{"text":"Replaces the hour with 15","type":"text"},{"type":"hardBreak"},{"text":"Replaces the minutes with 30","type":"text"},{"type":"hardBreak"},{"text":"Replaces the seconds with 20","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Tuesday, 06 March 2018, 15:30:20","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() >> 2M","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Forward to ","type":"text"},{"text":"next","type":"text","marks":[{"type":"strong"}]},{"text":" second month","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Monday","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":", 05 February ","type":"text"},{"text":"2018","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":", 13:37:05","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() << 2M","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Backward to ","type":"text"},{"text":"previous","type":"text","marks":[{"type":"strong"}]},{"text":" second month","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Friday","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":", 05 February ","type":"text"},{"text":"2016","type":"text","marks":[{"type":"textColor","attrs":{"color":"#ff5630"}}]},{"text":", 13:37:05","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() >> 2M6d15h20m10s","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Forward to ","type":"text"},{"text":"next","type":"text","marks":[{"type":"strong"}]},{"text":" second month, sixth day, fifteenth hour, twentieth minute and 10 seconds","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Tuesday, 06 February 2018, 15:20:10","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"now() << 1h/1d","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Goes back to the first hour of the current day. Minutes and seconds don't change.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[226.67]},"content":[{"type":"paragraph","content":[{"text":"Sunday, 05 February 2017, 01:37:05","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Query performed by a global search","type":"text"}]},{"type":"paragraph","content":[{"text":"When you perform a global search, you will access the ","type":"text"},{"text":"all.data","type":"text","marks":[{"type":"code"}]},{"text":" table filtered by the expression you searched for. The default operation used is ","type":"text"},{"text":"Contains tokens (toktains)","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/v7100/pages/94752634"}}]},{"text":". You will see the operation performed under the text box while you enter the expression to look for. This would be the resulting query:","type":"text"}]},{"type":"codeBlock","content":[{"text":"from all.data\nwhere weaktoktains(message, \"user@devo.com\")","type":"text"}]},{"type":"layoutSection","content":[{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"mediaSingle","attrs":{"layout":"center","width":80.0},"content":[{"type":"media","attrs":{"width":255,"id":"89596869-cb08-4ae9-9099-5727d501be61","collection":"contentId-94742606","type":"file","height":143}}]},{"type":"paragraph"}]},{"type":"layoutColumn","attrs":{"width":50.0},"content":[{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Note that this operation is case sensitive. To ignore case, access your user or domain settings in the ","type":"text"},{"text":"Preferences ","type":"text","marks":[{"type":"strong"}]},{"text":"area and choose ","type":"text"},{"text":"Case insensitive","type":"text","marks":[{"type":"strong"}]},{"text":" in the ","type":"text"},{"text":"Default case sensitivity in searches","type":"text","marks":[{"type":"strong"}]},{"text":" dropdown. In this case, the operation would be ","type":"text"},{"text":"Contains tokens - case insensitive (weaktoktains)","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.devo.com/confluence/pages/viewpage.action?pageId=44283711"}}]},{"text":".","type":"text"}]}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":483,"id":"bb4ce211-e885-42eb-8beb-26080d5873e5","collection":"contentId-94742606","type":"file","height":69}}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Table columns in a global search","type":"text"}]},{"type":"paragraph","content":[{"text":"You can find the following columns with the following information in the table:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"bf829466-900b-42bb-9306-accc5bec3cc9"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"eventdate","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The date and time in which Devo received the event.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"technology","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The first and highest tag level. It indicates the type of technology from which the data comes.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"brand","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The second tag level. It indicates the vendor of the aforementioned technology.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"phylum","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The third tag level and the first optional, also known as type. It describes and categorizes the data source inside the company.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"family","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The fourth tag level and the second optional, also known as subtype 1. It further describes and categorizes the data source in case subdivisions are necessary.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"genus","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The fifth tag level and the third optional, also known as subtype 2. If further describes and categorizes the data source in case more subdivisions are necessary. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"species","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The sixth and lowest tag level and the fourth optional, also known as subtype 3. It further describes and categorizes the data source in case even more subdivisions are necessary.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"tables","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The tables in which the token appears.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"hostName","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The name of the machine from which the event originated.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"hostIp","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The IP address of the machine from which the event originated.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[145.0]},"content":[{"type":"paragraph","content":[{"text":"message","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[1655.0]},"content":[{"type":"paragraph","content":[{"text":"The data received in the event.","type":"text"}]}]}]}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Be aware that sometimes the tags from the columns do not coincide with the tables in which the token appears. This is because those tables extract information and metadata from the ones in which they actually appear.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Global search result","type":"text"}]},{"type":"paragraph","content":[{"text":"In the capture below, we have entered the term ","type":"text"},{"text":"info ","type":"text","marks":[{"type":"em"}]},{"text":"to check the events containing that word in all the tables in our domain. You can filter the table so that only those events contained in specific tables are shown. To do that, you can use the ","type":"text"},{"text":"Any name matches (anymatches)","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/v7100/pages/94751155"}}]},{"text":" operation.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":100.0},"content":[{"type":"media","attrs":{"width":1315,"id":"9ed6421d-71d8-4736-a8ce-85b11830c79d","collection":"contentId-94742606","type":"file","height":353}}]},{"type":"paragraph","content":[{"type":"hardBreak"}]}],"version":1}

Browser not supported