Skip to content

DOCS-1755 - Document Search Assist Filter #6933

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JV0812 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

DOCS-1755 - Document Search Assist Filter #6933

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1cf5ab1
DOCS-1755 - Document Search Assist Filter
JV0812 Jul 21, 2026
fe54150
Merge branch 'main' into DOCS-1755-search-assist-filter
JV0812 Jul 21, 2026
58defe0
DOCS-1755 - Clarify filter requires manual search per review
JV0812 Jul 21, 2026
2e54fe8
minor fix
JV0812 Jul 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions blog-service/2026-07-24-search.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
---
title: Filter Search Results from a Column (Search)
image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082
keywords:
- search
- filter
- search results
hide_table_of_contents: true
---

We're excited to introduce the Search Assist Filter, which lets you filter your search results directly from a results-table column instead of manually typing a filter clause into your query. [Learn more](/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab/#filter-results-from-a-column).
19 changes: 19 additions & 0 deletions docs/search/get-started-with-search/search-page/modify-search-from-messages-tab.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ After running a search, you can make these changes in the **Messages** tab:

* [Add to your search](#add-toyour-search)
* [Parse a field from message text](#parse-a-field-from-message-text)
* [Filter results from a column](#filter-results-from-a-column)
* [Format JSON messages in search results](../search-basics/view-search-results-json-logs.md)

### Add to your search
Expand Down Expand Up @@ -45,6 +46,24 @@ To parse a field from message text:
:::
1. In the **Search** tab, click **Start** to being the search.

### Filter results from a column

You can filter your search results directly from a column in the **Messages** tab instead of typing a filter clause into the query. When you apply a filter, Sumo Logic adds a `where` clause to your query and reruns the search.

To filter results from a column:

1. Run a search. In the **Messages** tab, click the filter icon in the header of the column you want to filter.<br/><img src={useBaseUrl('img/search/get-started-search/search-page/search-assist-filter.png')} alt="Filter icon and filter panel on a search results column" style={{border: '1px solid gray'}} width="800" />

@kimsauce kimsauce Jul 22, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I pulled this image from the branch to check it — it's an annotated demo capture with red boxes/arrows labeling "String fields" and "Number fields" over the filter icons. It doesn't actually show the filter panel, operator dropdown, or Top 10 values list that the next two steps describe, so the alt text ("Filter icon and filter panel on a search results column") overstates what's shown. It also has internal host/cluster identifiers visible (e.g. epd_dev1_cluster, org-service-5fc5b766b6-697nz) — matches what you flagged in the PR description. Worth replacing with a masked capture that shows the actual filter panel before publish.

1. Choose an operator and provide a value.
- **String fields**. Select an operator such as **Text contains**, **Text does not contain**, or **Text starts with**, then enter a value. You can also select a value from the **Top 10 values** list, which shows the most common values in the column with their approximate counts.
- **Number fields**. Select an operator such as **Greater than**, **Less than**, or **Equal to**, then enter a value.
Comment on lines +57 to +58

@kimsauce kimsauce Jul 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per the PR notes, these operator lists are phrased "such as" because they reflect only what the demo showed.

1. Click **Apply**. Sumo Logic adds the filter to your query as a `where` clause (for example, `| where _size > 1000`) and refreshes the results.
Comment thread
JV0812 marked this conversation as resolved.
Outdated

:::note
- You can filter on one value at a time. Multi-select is not currently supported.
- When you apply filters on multiple columns, they combine with an `AND`. Contradictory filters return no results.
- Applying a filter returns you to the first page of results.
:::

## Aggregates tab

After running an [aggregate](/docs/search/search-query-language/group-aggregate-operators) search, you can copy values and select from several options to add more operations to your query based on the results in the **Aggregates** tab.
Expand Down
Binary file added static/img/search/get-started-search/search-page/search-assist-filter.png
View file
Open in desktop
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.