diff --git a/blog-service/2026-07-24-search.md b/blog-service/2026-07-24-search.md new file mode 100644 index 00000000000..cbc8b133223 --- /dev/null +++ b/blog-service/2026-07-24-search.md @@ -0,0 +1,11 @@ +--- +title: Filter Search Results from a Column (Search) +image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 +keywords: + - search + - filter + - search results +hide_table_of_contents: true +--- + +We're excited to introduce the Search Assist Filter, which lets you filter your search results directly from a results-table column instead of manually typing a filter clause into your query. [Learn more](/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab/#filter-results-from-a-column). diff --git a/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab.md b/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab.md index c0abadba457..c733a559e3e 100644 --- a/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab.md +++ b/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab.md @@ -14,6 +14,7 @@ After running a search, you can make these changes in the **Messages** tab: * [Add to your search](#add-toyour-search) * [Parse a field from message text](#parse-a-field-from-message-text) +* [Filter results from a column](#filter-results-from-a-column) * [Format JSON messages in search results](../search-basics/view-search-results-json-logs.md) ### Add to your search @@ -45,6 +46,25 @@ To parse a field from message text: ::: 1. In the **Search** tab, click **Start** to being the search. +### Filter results from a column + +You can filter your search results directly from a column in the **Messages** tab instead of typing a filter clause into the query. When you apply a filter, Sumo Logic adds a `where` clause to your query, which you then run to see the narrowed results. + +To filter results from a column: + +1. Run a search. In the **Messages** tab, click the filter icon in the header of the column you want to filter.
Filter icon and filter panel on a search results column +1. Choose an operator and provide a value. + - **String fields**. Select an operator such as **Text contains**, **Text does not contain**, or **Text starts with**, then enter a value. You can also select a value from the **Top 10 values** list, which shows the most common values in the column with their approximate counts. + - **Number fields**. Select an operator such as **Greater than**, **Less than**, or **Equal to**, then enter a value. +1. Click **Apply**. Sumo Logic adds the filter to your query as a `where` clause (for example, `| where _size > 1000`). +1. Click the search button to run the updated query. + +:::note +- You can filter on one value at a time. Multi-select is not currently supported. +- When you apply filters on multiple columns, they combine with an `AND`. Contradictory filters return no results. +- Applying a filter returns you to the first page of results. +::: + ## Aggregates tab After running an [aggregate](/docs/search/search-query-language/group-aggregate-operators) search, you can copy values and select from several options to add more operations to your query based on the results in the **Aggregates** tab. diff --git a/static/img/search/get-started-search/search-page/search-assist-filter.png b/static/img/search/get-started-search/search-page/search-assist-filter.png new file mode 100644 index 00000000000..b2a2dfa6b52 Binary files /dev/null and b/static/img/search/get-started-search/search-page/search-assist-filter.png differ