Content packs contain dashboards, extracted fields, saved queries, and alerts that are related to a specific product or set of logs. You can enable or disable a content pack, export or import a content pack, and remove a content pack.

To view the content packs that are loaded on your system, expand the main menu and select Content Packs.

Content packs are categorized into tabs as public and private. Public content packs are provided by VMware and third-party partners and are already installed. Private content packs are provided by external sources and you need to install them.

To view the details of a content pack, on a tab in the Content Packs page, click any of the content packs displayed. The information for the content pack is displayed in the following subtabs:

Info
Detailed information about the content pack.
Dashboards
The list of dashboards in the content pack. Click each dashboard to view it on the Content Pack Dashboards tab of the Dashboards page. Click each widget in the dashboard to view the query associated with the widget in the Explore Logs page.
Queries
The list of queries in the content pack. Click each query to view the query details in the Explore Logs page.
Alerts
The list of alerts in the content pack. Click each alert to view the alert details in the Alert Definitions page.
Extracted Fields
The list of extracted fields in the content pack. Click each extracted field to view the query to which the field is added in the Explore Logs page.
Note:
  • You can view the details for a content pack only if it is enabled.
  • Content pack dashboards are read-only. You cannot delete or rename them. However, you can clone content pack dashboards to your custom dashboard.