Skip to content

Manage Forwarding Rules

Rules List

All created data forwarding rules can be viewed in the Manage > Data Forwarding > Forwarding Rules list. You can manage the list through the following operations:

  • Search by entering the rule name;

  • Enable or disable the current rule;

  • Click the search, edit, or delete button on the right side of the rule to perform the corresponding operation;

  • Select multiple rules for batch operations.

Note
  • There may be a delay of up to 1 hour when viewing forwarded data;
  • In edit mode, the access type and region cannot be adjusted; rules stored in TrueWatch will have the same content for editing and viewing;
  • After deleting a rule, the forwarded data will not be deleted, but no new data will be generated.

Data Explorer

On the "Data Explorer" page, you can search and query the latest data results based on the time range and forwarding rules. You can also search fields directly using the key:value format. The system will fetch matching data in batches based on the selected time, returning 50 entries per batch. If no data is found in the first query or fewer than 50 entries are returned, you can manually click "Continue Query" until the scan is complete.

Search Query Logic

You can use the field :~ value format for search queries, which employs a regular expression matching logic.

  • The system will return all content containing the field:value string, meaning that if you input a search condition like host:~ hangzhou, all data containing host: hangzhou will be returned. Exact matching is not supported;
  • The relationship between multiple filter conditions is AND.

Data Forwarding Query Duration

After configuring the query duration, the time range for viewing forwarded data will be affected by the duration configuration here.

  1. Go to Manage > Workspace Settings > Advanced Settings > Configure Query Duration;
  2. Select the duration;
  3. Confirm.