You can load queries from content packs or queries that you saved to view them in the Explore Logs page.

Saved queries are separate from dashboard items. They do not appear on any custom dashboard. If you want to view a saved query, you have to load it.

All users, including administrators, have an individual list of saved queries.

Prerequisites

Verify that you are logged in to the VMware Aria Operations for Logs web user interface as a user associated with the User role, or a role that has the relevant permissions. For more information, see Create and Modify Roles in Administering VMware Aria Operations for Logs. The URL format of the web user interface is https://operations_for_logs-host, where operations_for_logs-host is the IP address or host name of the VMware Aria Operations for Logs virtual appliance.

Procedure

  1. Expand the main menu and click Explore Logs.
  2. Click the Favorite queries icon ""
  3. In the Favorite Queries list, click the query that you want to view in the Explore Logs page.
    The query is loaded in the Explore Logs page. The time range of the query is displayed above the list of events.

What to do next

You can add the query to a dashboard, change the granularity of the chart, or apply additional filtering to the query results.