Investigating Views

This topic explains how to use the Console's Analyze in Channel command to refine and explore channels contextually, using attributes of the events already being displayed in grid views.

The Analyze in Channel command uses these attributes, and the values found in their events, to automatically formulate simple filters or conditions.

When you create or refine a filter through Analyze in Channel, the Viewer panel automatically opens a new view of the channel with the filter applied. You explore the filter's effect in this view. You can keep the view by saving the channel under a new name, or discarding it by right-clicking in the grid and choosing Close.

When you use Analyze in Channel to add a condition to a resource editor such as Rules or Filters, the condition appears in the editor panel where you can modify it or click Apply to put it into effect.

The new or modified views you generate with the Analyze in Channel command can be grids, or you can choose to display them in applicable chart formats using the Viewer Selector icon in the lower-right corner of the Viewer panel.

To learn more about the event attributes these options use, see Data Fields.