Interesting fields are the relevant fields presented on the basis of the data distribution for the following types of queries:
Simple Search (except the Table and Time Functions commands)
Filtering Commands (except the latest command and the search command)
After you perform a search, the interesting field is displayed at the bottom-left side of the search page. It displays the top 15 fields, sorted according to the occurrence of the fields in the search result.
Interesting Fields¶
The parameters used to measure the data distribution are:
Percentage (%) - Displays the percentage of occurrences of a given field.
Count (# of values) - Displays the number of unique values for the given field.
Mean Deviation - Displays the value of the deviation from the average occurrence of the given fields.
Median Deviation - Displays the value of the deviation from the fields with the highest number of similar occurrences.
Warning
Logpoint does not generate the values of the Interesting Fields if you have hidden the Histogram from User Interface and collapsed Interesting Fields.
You can sort the Interesting Fields either by clicking on the field header or the parameter header.
You can view the details of the interesting fields by clicking on the field from the list. A pop-up appears, containing the total number of occurrences of the selected field and its Top 10 values with their distinct counts and percentages.
You can add fields to the Interesting Fields in the following ways:
When you click Select Fields, All Fields is displayd which lists the top 100 fields from the search results. You can select the fields from the list and the relevant parameter from the Parameter to display drop-down to add them in the Interesting Fields.
Click Add Fields to enter the names of the fields. You can add a maximum of 20 fields. You cannot add special characters or unicode characters. These fields are added in Interesting Fields and in the All Fields regardless of their occurrence in the search result. You can view these fields in a different colored text in Interesting Fields.
You can select Add this field to interesting fields from the drop-down menu on the key-value pairs to add the required field in Interesting Fields. The fields added from here are added in Add Fields.
Important
The Percentage (%) parameter is displayed in Interesting Fields by default. If the percentage of a field is less than 0.005, it is displayed as 0.
The Interesting Fields feature is enabled by default. You can disable Interesting Fields by selecting the Disable Interesting Fields in Search Page option under My Preferences >> Search. You can also collapse or expand Interesting Fields by clicking the window header.
Interesting Fields is disabled if:
The Data Privacy Module is enabled in your system.
The queries Aggregators, Pattern Finding, Table, Time Functions, search, or latest are used.
The values of the parameters in Interesting Fields are approximated if:
The number of fields in Interesting Fields is more than 100.
The distinct count of the given field is more than 100.
The fields log_ts, col_ts, msg, logpoint_name, repo_name, and label are not supported in Interesting Fields.
The Loading Interesting Fields icon appears in the search result tool bar if the system takes time to load the values in Interesting Fields. The icon disappears once the values are completely loaded.