In Devo, an event is a single collection of data, as is a record in a log file. All events have tags assigned to them to identify some key characteristics and to group them into virtual data tables in Devo.
When you run a search in Devo, you always access a data table where those events classified with the same tag are stored. Each table collects the events in rows and a parser associated with the event tag is used to sort the event information into columns. The parser assigns data types (for example, string, integer, and so on) to each column in a table.
To run a search, you must access the data table where the events you need to work with are stored. You can do this going to the Data Search area in the navigation panel.
After selecting the required data table, you will access the search window, which includes several customization options that allow you to show only the columns you need, display specific information of the events or sort and filter the data. Then you can start manipulating the data using the wide range of operations Devo features in order to get the required information and build your required query. You can, for example, create additional columns, group the data using a specific period of time or aggregate the data to apply specific calculations. You can create several paths of operations within a single search, which allows you to access multiple query levels just with one click.
The following articles guide you through the data search process:
- Accessing data tables
- Working in the search window
- Managing your queries
- Best practices for data search