Skip to content

Manage Forwarding Rules

Rules List

All created data forwarding rules can be viewed in the Manage > Data Forwarding > Forwarding Rules list. You can manage the list through the following operations:

  • Search by entering the rule name;

  • Enable or disable the current rule;

  • Click the search, edit, or delete button on the right side of the rule to perform the corresponding operation;

  • Select multiple rules for batch operations.

Note
  • There may be a delay of up to 1 hour when viewing forwarded data;
  • In edit mode, the access type and region cannot be adjusted; Rules stored in TrueWatch have consistent content for editing and viewing;
  • After deleting a rule, the forwarded data will not be deleted, but no new data will be generated.

Data Explorer

On the "Data Explorer" page, you can search and query the latest data results based on the time range and forwarding rules. Here, you can also directly search for fields using the key:value format. The system will fetch matching data in batches based on the selected time, returning 50 entries per batch. If no data is found or fewer than 50 entries are returned in the first query, you can manually click "Continue Query" until the scan is complete.

Search Query Logic

You can use the field :~ value format for search queries, which employs regular expression matching logic.

  • The system will return all content containing the field:value string, meaning that if you input a search condition like host:~ hangzhou, all data containing host: hangzhou will be returned, and exact matching is not supported;
  • Multiple filter conditions can be connected using AND or OR.

Data Forwarding Query Duration

After configuring the query duration, the query time range when viewing forwarded data will be affected by the duration configuration here.

  1. Go to Manage > Workspace Settings > Advanced Settings > Configure Query Duration;
  2. Select the duration;
  3. Confirm.