XpoLog Search Engine help - Search Portal 
 
Starting with version 2.7, XpoLog comes with a search engine that supports rapid textual search in logs. This enhanced search capability is integrated both in the log viewer (utilized by the filters and the quick search) and in a search engine screen that enables to search for text within multiple logs. The search engine search capability is based on an indexing mechanism that can run both automatically and upon user request. Only indexed logs are used by the search engine.

Searching

Click the Search Engine component to enter the search portal.
You can perform both simple, straightforward searches and advanced searches. For a simple search, simply enter the search term in the 'Search for' text box and press enter or click the 'go' link. Writing down a single word or a list of words will cause XpoLog to search all logs in which at least one of the words appear (OR operation). You can also define a regular expression as a search term. Searching a regular expression allows you to use wildcards anywhere within the search term, but it might cause for longer search times - especially if the wildcards appear at the beginning of the search term.

The result of a search query is a list of logs with indexing information and log information displayed next to each log result. By clicking on a search log result you drill down to that log's log view, where only records containing the search term are displayed. XpoLog creates for that view a temporary filter based on the search term. If you wish, you can enter the filter definition, edit it and save it.
To get a merged view of the result logs select the 'Merge results' link in the results status line. Select the logs you want to participate in the merged result. By clicking the 'view' link, XpoLog will create a temporary merge log based on the selected logs and will show it in the log view, again with a temporary filter based on the search term. Clicking the 'save and view' link will create and save the merge log and will then open its log view.

Clicking on the 'advanced' link will open the advanced search information section. If a different number results per page is desired, override the search engine default in the 'Results per page' entry.
If you want to search for logs where all the search terms appear, select in the 'Find Results' section the 'with all of the words' option. Otherwise use the 'with at least one of the words' option.
In the 'Search in' section, selecting 'only selected logs' will display the 'Select indexed logs' link that opens the logs tree. Only logs which use indexing and have been indexed will appear in that tree. Select the logs and folders to participate in the search.  Click on the 'Hide selected logs' to hide the logs tree.
By default XpoLog searches the search term only within its own logs. To perform the search also on logs residing in remote XpoLog nodes, select these nodes in the XpoLog nodes list in the 'Search on' section.

Running a search with a given search term will create a new 'user search result' entry that will be displayed in the 'Search Results' slide of the management pane on the left side of the screen. This way you can return to previously performed searches. Right click a search result and select 'Remove search' to remove it from the search results list, or click the small arrow in the 'Search Results' slide title and select 'Clear searches' to delete all pervious searches.

 

Additional links

      Search Engine Administration
      Regular Expressions