Filter¶

In the Explorer, you can filter and query data by specifying the field name and field value.

Note

The main difference between filtering and searching is whether the input contains : (colon separator). If it exists, it is considered a filter condition; if it does not, it is considered a search condition.

Operators¶

Different types of fields support different operators, as follows:

String field operators: =, ≠, match, not match, wildcard, not wildcard, exist, not exist, regexp, not regexp;
Numeric field operators: =, ≠, >, >=, <, <=, [xx TO xx], exist, not exist.

Operator	Description
`=`	Equal to, example: `attribute:value`
`≠`	Not equal to, example: `-attribute:value`
`match`	Contains, example: `attribute:~value`
`not match`	Does not contain, example: `-attribute:~value`
`wildcard`	Contains, requires wildcard for fuzzy query, example: `attribute:value`
`not wildcard`	Does not contain, requires wildcard for reverse fuzzy query, example: `attribute:value`
`exist`	Exists, filters data with the specified field, example: `attribute:*`
`not exist`	Does not exist, filters data without the specified field, example: `-attribute:*`
`regexp`	Regular expression match, uses regex to match the target string, example: `attribute:/value.*/`
`not regexp`	Reverse regular expression match, uses the target string to match the regex, example: `-attribute:/value.*/`
`>`	Greater than, example: `attribute:>value`
`>=`	Greater than or equal to, example: `attribute:>=value`
`<`	Less than, example: `attribute:<value`
`<=`	Less than or equal to, example: `attribute:<=value`
`[xx - xx]`	Range, example: `attribute:[1 - 100]`

Wildcard¶

Supports * or ? wildcards, where:

* matches 0 or more arbitrary characters;
? matches 1 arbitrary character.

Example:

Value: guanceyun

# Only using suffix * matching, suitable for cases where the prefix of a value is fixed and the latter part is dynamic
attribute:guance*    // * matches yun

# Only using ? matching, suitable for cases where only certain fixed position characters are dynamically updated
attribute:gua?ceyun   // ? matches n

# ? * combined use
attribute:gua?ce*   // ? matches n ,* matches yun

# * mixed use
attribute:gua*e*   // The first * matches nc , the second * matches yun

Special Characters¶

In the Explorer, certain characters have special meanings, such as space used to separate multiple words. If the search content contains the following special characters, special handling is required: space, :, ", “, \, (, ), [, ], {, }.

For more details, refer to Special Character Escaping Query.

Boolean Operators¶

Supports further combining and associating searches and filters in the form of AND/OR/NOT.

Logical Relationship	Description	Notes
a AND b	Intersection of the previous and next query results	By default, search and filter conditions are connected using AND. `AND` can be replaced with `space`, i.e., `a` AND `b` = `a` `b`.
a OR b	Union of the previous and next query results	The returned result must contain either a or b. Example: `a` OR `b:value`
NOT c	Excludes the current query result	NOT is mostly used in search syntax; exclusion logic in filtering uses `≠` instead.

Notes¶

Grouping¶

Use parentheses () to increase the priority of data query conditions. If parentheses exist in the query, the query logic inside the parentheses is executed first. The priority inside the parentheses still follows the order NOT > AND > OR.

Manual Mode¶

Supports switching the search box to manual mode.

Covers all Explorers (except dashboards/custom Explorers). In this mode, you can add search and filter conditions through UI interaction, and freely switch between manual mode and UI mode without any changes to the content before switching, achieving real-time switching and restoration between UI and manual input.

Quick Filter¶

In the Explorer, you can edit Quick Filter to add new Filter Fields. Two configuration methods are supported:

In Quick Filter, preset fields are supported. Newly added fields default to the field type in field management. If the field does not exist in field management, it defaults to text format.

Workspace-level Filter ItemsPersonal-level Filter Items

Configured by administrators or owners.

Available to all members of the workspace, but ordinary members and standard members cannot edit, delete, or move positions.

All members can configure Quick Filter items based on the local browser.

Only visible to the current user, other members of the workspace cannot view them.

After entering the field editing interface, two parts of fields are displayed:

Filter Fields: Fields displayed in Quick Filter;
Optional Fields: All fields cached by the current data type.

You can perform the following operations:

Search fields; if there is no exact match in the query results, you can directly create and add to "Filter Fields";
Edit field aliases;
Drag to adjust field order;
Delete fields;
Set whether to display field aliases.

Other Operations¶

Select Only This Item/Cancel SelectionFilter Item SearchField Value SearchDimensional AnalysisDuration

Clicking the row where the tag value is located means positively selecting this value Select Only This Item, continuing to check the checkboxes of other values means positively multi-selecting; when positively selecting a certain value, clicking the row where the value is located again Cancel Selection, cancels all filters.

When there are more than 10 tag fields in Quick Filter, fuzzy search by field name or display name is supported.

When there are more than 10 field attribute values in Quick Filter, real-time search by entering text is supported, and fuzzy matching and reverse fuzzy matching buttons are supported for filtering.

Clicking will switch the current Explorer to Analysis Mode, and this field will be automatically substituted into "Analysis Dimensions" for querying.

If the Quick Filter of the Explorer contains the duration field, you can manually adjust the maximum and minimum values for query analysis.

The default minimum and maximum values of the progress bar are the minimum and maximum duration in the link data list;
If the input format is incorrect, the input box will turn red, and no search will be performed. The correct format is pure "numbers" or "numbers+ns/μs/ms/s/min"
If no unit is entered for searching, "s" will be added by default after the input number for filtering;
If a unit is manually entered, the search will be performed directly.

Filter History¶

You can view filter and search history, and apply it to different Explorers in the current workspace. Click the icon on the right side of the search bar above the Explorer, or use the shortcut (Mac OS: shift+cmd+k / Windows: shift+ctrl+k) to quickly open Filter History;