diff --git a/blog-service/2026-07-24-search.md b/blog-service/2026-07-24-search.md new file mode 100644 index 00000000000..cbc8b133223 --- /dev/null +++ b/blog-service/2026-07-24-search.md @@ -0,0 +1,11 @@ +--- +title: Filter Search Results from a Column (Search) +image: https://assets-www.sumologic.com/company-logos/_800x418_crop_center-center_82_none/SumoLogic_Preview_600x600.jpg?mtime=1617040082 +keywords: + - search + - filter + - search results +hide_table_of_contents: true +--- + +We're excited to introduce the Search Assist Filter, which lets you filter your search results directly from a results-table column instead of manually typing a filter clause into your query. [Learn more](/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab/#filter-results-from-a-column). diff --git a/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab.md b/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab.md index c0abadba457..4936ec1a37e 100644 --- a/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab.md +++ b/docs/search/get-started-with-search/search-page/modify-search-from-messages-tab.md @@ -14,6 +14,7 @@ After running a search, you can make these changes in the **Messages** tab: * [Add to your search](#add-toyour-search) * [Parse a field from message text](#parse-a-field-from-message-text) +* [Filter results from a column](#filter-results-from-a-column) * [Format JSON messages in search results](../search-basics/view-search-results-json-logs.md) ### Add to your search @@ -45,6 +46,25 @@ To parse a field from message text: ::: 1. In the **Search** tab, click **Start** to being the search. +### Filter results from a column + +You can filter your search results directly from a column in the **Messages** tab instead of typing a filter clause into the query. When you apply a filter, Sumo Logic adds a `where` clause to your query, which you then run to see the narrowed results. + +To filter results from a column: + +1. Run a search. In the **Messages** tab, click the filter icon in the header of the column you want to filter.
Search results column headers with the filter icon highlighted, annotated to show String fields and Number fields +1. Choose an operator and provide a value. + - **String fields**. Select an operator such as **Text contains**, **Text does not contain**, or **Text starts with**, then enter a value. You can also select a value from the **Top 10 values** list, which shows the most common values in the column with their approximate counts. + - **Number fields**. Select an operator such as **Greater than**, **Less than**, or **Equal to**, then enter a value. +1. Click **Apply**. Sumo Logic adds the filter to your query as a `where` clause (for example, `| where _size > 1000`). +1. Click **Start** (or press Enter/Return) to run the updated query. + +:::note +- You can filter on one value at a time. Multi-select is not currently supported. +- When you apply filters on multiple columns, they combine with an `AND`. Contradictory filters return no results. +- Applying a filter returns you to the first page of results. +::: + ## Aggregates tab After running an [aggregate](/docs/search/search-query-language/group-aggregate-operators) search, you can copy values and select from several options to add more operations to your query based on the results in the **Aggregates** tab. diff --git a/static/img/search/get-started-search/search-page/search-assist-filter.png b/static/img/search/get-started-search/search-page/search-assist-filter.png new file mode 100644 index 00000000000..b70cec22fc9 Binary files /dev/null and b/static/img/search/get-started-search/search-page/search-assist-filter.png differ