Explore data with Axiom
Learn how to filter, manipulate, extend, and summarize your data.
The Explore tab provides you with robust computation and processing power to get deeper insights into your data. It enables you to filter, manipulate, extend, and summarize your data.
Use the Explore tab
Go to the Explore tab and choose one of the following options:
You can easily switch between these two methods at any point when creating the query.
Create a query using the visual query builder
- In the top left, click Builder.
- From the list, select the dataset that you want to query.
- Optional: In the Where section, create filters to narrow down the query results.
- Optional: In the Summarize section, select a way to visualize the query results.
- Optional: In the More section, specify additional options such as sorting the results or limiting the number of displayed events.
- Select the time range.
- Click Run.
See below for more information about each of these steps.
Add filters
Use the Where section to filter the results to specific events. For example, to filter for events that originate in a specific geolocation like France.
To add a filter:
- Click + in the Where section.
- Select the field where you want to filter for values. For example,
geo.country
. - Select the logical operator of the filter. These are different for each field type. For example, you can use starts-with for string fields and >= for number fields. In this example, select
==
for an exact match. - Specify the value for which you want to filter. In this example, enter
France
.
When you run the query, the results only show events matching the criteria you specified for the filter.
Add multiple filters
You can add multiple filters and combine them with AND/OR operators. For example, to filter for events that originate in France or Germany.
To add and combine multiple filters:
- Add a filter for France as explained in Add filters.
- Add a filter for Germany as explained in Add filters.
- Click and that appears between the two filters, and then select or.
The query results display events that originate in France or Germany.
You can add groups of filters using the New Group element. Axiom supports AND/OR operators at the top level and one level deep.
Add visualizations
Axiom provides powerful visualizations that display the output of aggregate functions across your dataset. The Summarize section provides you with several ways to visualize the query results. For example, the count
visualization displays the number of events matching your query over time. Some visualizations require an argument such as a field or other parameters.
For more information about visualizations, see Visualize data.
Segment data
When visualizing data, segment data into specific groups to see more clearly how the data behaves. For example, to see how many events originate in each geolocation, select the count
visualization and group by geo.country
.
More options
In the More section, specify the following additional options:
- By default, Axiom automatically chooses the best ordering for the query results. To specify the sorting order manually, click Sort by, and then select the field according to which you want to sort the results.
- To limit the number of events the query returns, click Limit, and then specify the maximum number of returned events.
- Specify whether to display or hide open intervals.
Select time range
When you select the time range of a query, you specify the time interval where you want to look for events.
To select the time range, choose one of the following options:
- Use the Quick range items to quickly select popular time ranges.
- Use the Custom start/end date fields to select specific times.
Special fields
Axiom creates the following two fields automatically for a new dataset:
_time
is the timestamp of the event. If the data you ingest doesn’t have a_time
field, Axiom assigns the time of the data ingest to the events._sysTime
is the time when you ingested the data.
In most cases, you can use _time
and _sysTime
interchangeably. The difference between them can be useful if you experience clock skews on your event-producing systems.
Create a query using APL
APL is a data processing language that supports filtering, extending, and summarizing data. For more information, see Introduction to APL.
Some APL queries are explained below. The pipe symbol |
separates the operations as they flow from left to right, and top to bottom.
APL is case-sensitive for everything: dataset names, field names, operators, functions, etc.
Use double forward slashes (//
) for comments.
APL count operator
The below query returns the number of events from the sample-http-logs
dataset.
['sample-http-logs']
| summarize count()
APL limit operator
The limit
operator returns a random subset of rows from a dataset up to the specified number of rows. This query returns a thousand rows from sample-http-logs
randomly chosen by APL.
['sample-http-logs']
| limit 1000
APL summarize operator
The summarize
operator produces a table that aggregates the content of the dataset. This query returns a chart of the avg(req_duration_ms)
, and a table of geo.city
and avg(req_duration_ms)
of the sample-http-logs
dataset from the time range of 2 days and time interval of 4 hours.
['sample-http-logs']
| where _time > ago(2d)
| summarize avg(req_duration_ms) by _time=bin(_time, 4h), ['geo.city']
Query results
The results view adapts to the query. This means that it adds and removes components as necessary to give you the best experience. The toolbar is always visible and gives details on the currently running or last-run query. The other components are explained below.
Query results without visualizations
When you run a query on a dataset without specifying a visualization, Axiom displays a table with the raw query results.
Select displayed fields
To select the fields displayed in the table, click , and then click the fields in the list that you want to display.
Configure table options
To configure the table options, click , and then select one of the following:
- Wrap lines
- Show timestamp
- Show raw
Event timeline
Axiom can also display an event timeline about the distribution of events across the selected time range. In the event timeline, each bar represents the number of events matched within that specific time interval. Holding the pointer over a bar reveals a blue line marking the total events and shows when those events occurred in that particular time range. To display the event timeline, click , and then click Show chart.
Drag the pointer over the event timeline to focus on the time range. The time range of your query automatically updates to match what you selected.
Query results with visualizations
When you run a query with visualizations, Axiom displays all the visualizations that you add to the query. Hold the pointer over charts to get extra detail on each result set.
Below the charts, Axiom displays a table with the totals from each of the aggregate functions for the visualizations you specify.
If the query includes group-by clauses, there is a row for each group. Hold the pointer over a group row to highlight the group’s data on time series charts. Select the checkboxes on the left to display data only for the selected rows.
Configure chart options
Click to access the following options for each chart:
- In Values, specify how to treat null values.
- In Variant, specify the chart type. Select from area, bar, or line charts.
- In Y-Axis, specify the scale of the vertical axis. Select from linear or log scales.
Merge charts
When you run a query that produces several visualizations, Axiom displays the charts separately. For example:
['sample-http-logs']
| summarize percentiles_array(req_duration_ms, 50, 90, 95) by status, bin_auto(_time)
To merge the separately displayed charts into a single chart, click , and then select Merge charts.
Compare time periods
On time series charts, holding the pointer over a specific time shows the same marker on similar charts for easy comparison.
When you run a query with a time series visualization, you can use the Compare period menu to select a historical time against which to compare the results of your time range. For example, to compare the last hour’s average response time to the same time yesterday, select 1 hr
in the time range menu, and then select -1 day
from the Compare period menu. The dotted line represents results from the base date, and the totals table includes the comparative totals.
Was this page helpful?