Logs table

The logs table is the default results view in Explore. It displays individual log entries as rows, with fields rendered as columns. Use the table to scan results, compare field values across entries, sort by specific columns, and open individual logs for deeper inspection.

Configure Content column fields

The Content column is the primary display column for each log entry. It shows the log message or the values of the fields you select. For nested JSON, the column keeps the inner structure but drops the outermost wrapping key.

To configure which fields appear in the Content column:

1. Select the icon on the Content column header. The Content Column displayed values panel opens.
2. Use the Prioritized keys section to pin specific fields to the top of the content cell, and the Available keys section to browse and add other fields.
3. Add or remove fields to control what appears in each row's content cell.

Changes apply immediately to all rows in the table.

Columns

Add, remove, reorder, and reset columns to customize what information appears in the table.

Add columns from column management

1. Select Columns in the table header.
2. Search for a field by name, or browse the list.
3. Select the field to add it as a column.
4. Drag the field to reorder it in the column list.
5. Close the panel to save your changes.

Drag the left edge of the panel to resize it — useful when field names or values are long enough to truncate in the default width. The panel keeps its position while you resize; your chosen width applies for the rest of the session.

Add a column from a log entry

You can also add a column directly from an individual log entry without opening the column management panel:

1. Select a log row to open the log details panel.
2. Find the field you want to add as a column.
3. Open the field's context menu (three dots or hover actions).
4. Select Add as a column.

The column appears immediately in the table.

Reset column layout

To restore the default column configuration:

1. Select Columns.
2. Select Reset to default.

This removes any custom columns and restores the original layout.

Sort or remove columns

• Sort: Select a column header to sort by that column. Select again to reverse the sort order. An indicator shows the active sort column and direction.
• Remove: Hover over a column header and select the remove icon, or open Columns and deselect the field.

Change row format

The logs table supports five row-display formats. Toggle the format using the display-options control in the table header.

• 1 line: one line per log entry. Use to scan high volumes quickly.
• 2 lines: two lines per entry, useful when messages are slightly longer than one row.
• JSON: renders each entry as formatted JSON. Use for structured logs when you want the full object visible inline.
• Condensed: denser layout that fits more entries on screen without truncating the message.
• List: list-style layout that surfaces key fields without raw JSON.

Export logs

Export the current results to a file for offline analysis or sharing:

1. Select Export in the table header.
2. Choose the export format (for example, CSV or JSON).
3. Confirm the export.

The export includes the logs matching your current query and time range, up to the supported export limit.

Row actions

Open the menu next to any row to access actions scoped to that row. The menu is row-type-aware — log rows expose the actions below; aggregation/grouping rows add See raw logs, Include in query, Exclude from query, and Copy value; trace and span rows add export and copy actions specific to those record types.

For a log row, the menu lists:

• Custom Actions: opens a list of custom actions configured for your account.
• Copy log: copies the full log entry to the clipboard.
• Copy log ID: copies the log's unique ID. Use this to share a permalink, correlate with an external system, or paste the ID into a query.
• Open info panel: opens the log details panel for the selected entry.
• View surrounding logs: opens a list of duration presets — 5 Seconds, 30 Seconds, 1 Minute, 5 Minutes, or 10 Minutes: to load logs from the same source within ± that interval of the selected event. The action drops any active filters and rebuilds the query with only a scoping clause: applicationName and subsystemName for logs, serviceName and operationName for spans, and session_context.session_id for the rum.events dataset. On the rum.events dataset, the action label changes to View surrounding events.
• Copy permalink: copies a URL that recreates the current query, time range, and selected log.

Add a log to Olly context

Send a specific log to Olly when you want to ask about that exact record instead of the full query result. The action lives in a right-pinned column in the logs table. The column has no header, and the button appears only when you hover the row.

1. Hover the log row you want to send to Olly. The Olly icon appears at the right edge of the row.
2. Select Add to Olly context.

Olly opens in a drawer with the log already attached as a data-context chip — labelled with the log's timestamp, with an entity icon, and a tooltip that reads Log: \<timestamp>. Add more rows by hovering other logs and selecting the same action; each one becomes its own chip. See Page and data context for chip behavior and removal.

The Olly column stays pinned to the end of the table and isn't part of the column layout — you can't move it, hide it from Manage columns, or include it in a saved view. The button doesn't appear on rows where the log has no resolvable ID.

Fields sidebar actions

Actions available from the Fields sidebar apply to the table view and modify the query or column layout.

Show the graph for the key

The chart appears above the results table. Each bar segment represents a distinct value for the selected field. Select any segment to drill down into the underlying logs or filter the value in or out of your query.

This action is equivalent to adding the field as a Group by with a Count aggregation and visualizing the result as a stacked bar chart.

Actions inside the panel

The graph-for-key panel and any other slide-in log panel that opens from a chart drilldown share the same row and cell actions as the main logs table:

• Open the more actions menu on any row to access Open info panel, View surrounding logs (or events on rum.events), Copy log, Copy permalink, and Custom Actions.
• Select a value in a row to open the same field-level context menu listed in Value menu, including Custom Actions. These panels skip the Value across time action since it points back to a panel you're already viewing.

Add as Grouping

Select Add as Grouping from the Fields sidebar context menu to add the field to the Grouped by clause in the Query Builder. The table switches from individual log rows to aggregated groups, showing each unique value and its count.

Other sidebar actions

The three-dot menu on each Fields sidebar entry also exposes:

• Add as a column / Remove from columns: manage which sidebar fields appear as table columns.
• Copy full path: copy the field's full dot-notation path.
• Add to favorites / Remove from favorites: pin or unpin the field at the top of the sidebar (per source and dataset).

Value rows under an expanded field provide Filter in and Filter out chip controls to quickly add the value as an inclusion or exclusion filter without opening the kebab menu.

Key-value context menu

Select a key or value in a log row to open a context menu of field-level actions. The available actions differ based on whether you selected a key or a value.

Key menu

Select a field name in a log row:

Action	Description
Custom Actions	Opens a list of custom actions scoped to the selected field.
Include in query	Adds the field as a filter on the current query.
Exclude from query	Adds the field as an exclusion filter on the current query.
Add as a column	Adds the field as a column in the logs table.
Add to favorite fields	Pins the field to the top of the Fields sidebar for the current source and dataset.
Copy full path	Copies the field's full path.
Copy the key's value	Copies the field's current value for this log.
Copy the key:value	Copies the full key:value pair.
Show the graph for the key	Opens a time-series bar chart grouped by this field. See Show the graph for the key for chart behavior.

Value menu

Select a field value in a log row:

Action	Description
Custom Actions	Opens a list of custom actions scoped to the selected value.
Include in query	Adds the field-value pair as an inclusion filter on the current query.
Exclude from query	Adds the field-value pair as an exclusion filter on the current query.
Query value	Replaces the entire query with a single filter for this value. Use this to pivot to a fresh search on the selected value without keeping prior filters.
Service drilldown	Opens the service catalog drilldown for the selected service. Only shown when the field is a service-name field.
Create metric alert	Generates a metric from the clicked field-value pair via the Events2Metrics flow and opens the metric-alert editor on it. Only shown when the value is numeric and you have both the Events2Metrics and metric-alert update permissions.
Copy full path	Copies the field's full path (for example, cx_rum.session_context.session_id).
Copy value to the clipboard	Copies the field value.
Copy key	Copies the field name.
Value across time	Opens a time-series chart of how often this field-value combination appears across the query's time range.
Live tail	Opens LiveTail filtered to the selected field-value pair. Only available for Application and Subsystem field values.
Open URL	Opens the value in a new browser tab. Only shown when the value is an http:// or https:// URL.

Next steps

Filter and search on the fields detected in your results with the Fields side bar.