Search logs and spans

Use the Lucene-powered search bar in Explore to find the exact logs and spans you need. Builder mode supports two input styles — a visual chip builder and a Lucene editor — and you can switch to the DataPrime syntax for advanced pipelines. As you search, Explore keeps your query, filters, and UI actions aligned so you can refine results without rebuilding your work.

Search bar with autocomplete showing suggested keys, recent searches, and syntax helpers

Before you begin

1. Select the dataset you want as your query data source.
2. Set the time range.

Your dataset and time range apply to every search you run until you change them.

Select the dataset

Use the dataset selector to choose the dataset you want to search (for example, a logs or spans dataset).

What happens when you change datasets:

• Explore keeps compatible selections when possible (same field name and type).
• Explore removes incompatible filters and selections.
• If the dataset has no data in the selected time range, you see an empty state. Expand the time range or adjust filters.

Set the time range

Use the time range control to define the window for your search (for example, Last 15 minutes, Last 24 hours, or a custom range).

You can also:

• Change the time range at any time. Results refresh to match your new selection.
• In time-series charts, highlight a segment of the chart to update the selected time range to that interval. This is useful when you spot a spike and want to zoom in.

Build your search query

In Builder mode the search bar offers two input styles that compile to the same Lucene query:

• Lucene editor: type the Lucene expression directly.
• Chip builder: build the query visually using chips for field, operator, and value.

Toggle between the two with the small icon next to the search bar. Switching keeps your query intact.

If you instead switch the top-level syntax to DataPrime, the editor reseeds with source <dataset> or a translated form of your Lucene query. Switching back to Builder restores your Lucene query only if you haven't edited the DataPrime — otherwise Explore opens a "Please note" dialog where you can Cancel, Open Lucene in new tab, or Discard query.

Use autocomplete while you type

When you place your cursor in the search bar, Explore opens an autocomplete panel that helps you build the query faster and more accurately.

The panel includes:

• Suggested keys: commonly used fields for the selected dataset.
• Recent searches: previously run searches you can reuse.
• All keys: the full set of searchable fields in the selected dataset.

As you build a clause, Explore guides you through the next step. For example, after you select a field, it prompts you to choose a value. After you complete a clause, it prompts you to choose what comes next, such as adding AND, OR, or NOT.

Tips for working quickly:

• Use the arrow keys to move through suggestions, then press Enter to accept the highlighted suggestion.
• Press Enter inside the Lucene editor to insert a new line — select Run to execute the query.

Use common operators

The autocomplete panel also provides operator patterns you can apply as you build queries, including:

• Starts with
• Exists in data (for example, _exists_)
• Exclude (for example, NOT)
• Free text
• Range (for example, [range_from TO range_to])

Use quotes for values that include spaces.

Run the search

Select Run to execute the search. If Explore detects an invalid query, it blocks execution until you fix the error.

In Builder mode the query auto-submits after edits that produce a complete, valid query — for example, applying a chip-builder clause or accepting an autocomplete suggestion. Free-text typing in the Lucene editor is staged but not auto-submitted, so you can still write multi-clause queries without partial runs. DataPrime is excluded from auto-submit (partial DataPrime queries would error out) — select Run, or use the Cmd+Enter / Ctrl+Enter / Shift+Enter keyboard shortcut, to run a DataPrime query.

After the search runs, results appear in the grid.

Review results

The data grid is your default view for inspecting individual logs, spans, and traces.

Common actions:

• Select a row to open the info panel.
• Use Columns to add fields so you can compare values across many logs without opening each one.
• Sort by a column to quickly find outliers (for example, the highest value in a numeric field).

Inspect a log in the info panel

When you select a log row, the info panel opens and shows details for the selected log. Use it to review the log's fields and drill into the full record.

From the info panel, you can:

• Search within the log details
• Use field-level actions to refine your investigation (for example, include or exclude a value in the query)

Find out more in Log details panel.

Check the distribution of a field from the table

When you want to understand how values are distributed for a specific field, open the context menu for a field value in the table and select Add as Grouping.

Explore opens a chart drilldown panel grouped by the selected field. Use this view to spot the most common values and pivot your investigation to a specific subset.

Examples

coralogix.metadata.severity:"Error"

_exists_:cx_rum.page_context.page_fragments

cx_rum.page_context.page_fragments:"alerts/{id}"

Next steps

Group, count, and compare results across any field with the Query builder.