Explore

Query on the Explore screen the events received by the platform within a time range. The query takes filters and grouping, and presents the result in a chart and in a table.

How to use

1. Define the time range

Select the date field that serves as the reference for the query and the desired range. The range takes shortcuts (5 minutes, 1 hour, 1 day, among others) or the start and end date and time entered manually.

2. Select the event type

Choose the event type to query. The fields offered for filtering and for grouping vary according to the selected type.

3. Apply filters (optional)

Add conditions to restrict the events displayed. Each filter combines a field, an operator and a value. On a sensitive field, the filter takes the original value or the hash copied from a result or an export.

A filter also takes operators without a value, duration values, the comparison between fields and lists.

4. Group the results (optional)

Select a field to group the events in the chart. With grouping, the chart displays the 10 categories with the most occurrences and consolidates the rest into an “others” category.

5. Run the query

After configuring the parameters, run the query to load the chart and the table.

Empty and Filled operators

The Empty and Filled operators do not require a value. Empty selects the records where the field was not provided; Filled selects the records where the field has some value. The pair isolates, for example, the payment events where the card issuer was not identified.

The filters for metrics and for exports offer the same operators.

Duration filters

A field presented as a duration accepts the value typed as time, in the same notation it is displayed in: 30s, 1h 30m, 2d. The platform converts the value to the stored unit.

Comparison between fields

A filter’s value can name another field of the same event type, written as $field_name, in place of a typed value. The platform compares the two columns row by row and selects the events where the relation between the columns is true. Autocomplete offers the fields when you type $, as it already does with @ for lists.

The typical use is locating where two fields disagree, for example a field and its _shadow twin, written by a version in observation:

decision  different from  $decision_shadow

A reference to a field applies to the whole condition: a filter compares either with a field or with typed values, not with both at once. The comparison works on the equality, difference and order operators, between fields of compatible types. A text field is not comparable with a numeric field.

Lists in filters

A filter can reference a list by name, with the @ prefix. The limit of a list in a filter is the total size of its values, not the number of items. The platform adds up the values of every list used in the filters of the same query, and a sensitive field’s values take up more space.

The limit applies to the filters of Explore, of monitors and of exports. A filter whose lists exceed the maximum size of a query is refused on saving. The message states the size of the lists and the limit.

If a list grows after the filter is saved and exceeds the limit, the platform does not cut the list:

Explore shows, in place of the result, the message “The lists used in the filters exceed the maximum size of a query. Reduce the lists or remove filters.”;
the monitor does not run for that window and records the failure in the _failure event type.

Saved searches

Save a configured query with a name and recover it later from the saved searches menu. A saved search keeps the filters, the grouping and the date field the screen had at the moment of saving. Saved searches are personal and tied to the event type, with a limit of 20 per event type.

Overwrite writes the screen’s current configuration over a saved search, which avoids saving a variation as a new search. Delete frees space when the limit is reached.

Chart

The chart displays the distribution of events over the selected time range. The Granularity selector defines the aggregation interval. On the Auto option, the platform chooses the most readable interval for the period and indicates which one was applied (for example, Auto (1 hour)).

Table

Below the chart, the table lists the individual events matching the query, with up to 1,000 records. Use the Load more button to advance through the results in batches of 25.

A click on a column header, or Enter or Space with the focus on the header, opens the column menu:

Option	What it does
View field	opens the field in the side panel, with the details, the items and the usages, the same panel as the event type’s fields screen
Copy ID	copies the field’s identifier
Hide column	hides the column and saves the column selection; the Column <name> hidden notice offers Undo

The Date and time and ID columns are not fields and do not offer View field. With every column hidden, the table shows the message “No columns selected”.

Expand a row to see the full details of the event.

Export