In a non-indexed partition, querying logs renders slow results. If you intend to query the logs frequently, you can move all or specific logs to a common recall partition for 30 days. In this partition, you can search and analyze the logs with quicker results. Create a configuration to copy logs from a non-indexed partition to the common recall partition.

Prerequisites

  • Verify that you have a premium or a trial subscription for VMware Aria Operations for Logs (SaaS).
    • If you have a trial subscription, you must activate log partitions before using the subscription. To activate partitions, go to Log Management > Log Partitions and click Enable Partitions.
    • If you have a free subscription, you cannot use log partitions.
    • If you have a premium subscription, log partitions are available by default, and you do not have to activate the feature.
    For information about subscriptions, see VMware Aria Operations for Logs (SaaS) Subscriptions and Billing.
  • Verify that you have at least one non-indexed log partition in the system.

Procedure

  1. Click the two arrows icon in the upper-left corner of the screen to expand the main menu.
  2. Navigate to Log Management > Log Partitions.
  3. In the upper-right corner, click Recall Logs.
  4. Provide the following information:
    Option Description
    Name Enter a unique display name for the recall configuration.
    Description Enter a description for the recall configuration.
    Select Partition Select the non-indexed partition for which you want to recall logs.
    Time Range and Filters for Recalling
    • Select a time range to recall logs within the range.
    • Select the option to recall all the logs in the partition or add filters to recall specific logs.
    Notify Optionally, you can notify certain users when the recall process for your configuration is finished.
  5. Click Recall.
    The recall process takes some time to finish, depending on the volume of logs being recalled. You can view the recall status of your configuration when you expand the Recalled Logs section in the Log Partitions page and click the name of the common recall partition.