---
title: "Build a query in the search window"
canonical: "https://docs.devo.com/space/latest/94764977/Build%20a%20query%20in%20the%20search%20window"
format: markdown
---
> Macro (toc)

The search window toolbar includes quick access to all these groups of operations for data querying.

![image](media://f76ffe0d-d215-496d-a5e8-b2246cf51d4d)

## Operations over fields window

The **Operations ****over fields** window opens when you select one of the operations above mentioned. This is where you define the required function and select the arguments needed for your query.

### (5) Create field and (1) Aggregate tabs

The **Create ****field** and **Aggregate** tabs contain the same fields. Both types of operations create a new field to contain the results of the selected operation performed on the selected argument(s), or fields. 

For example, the capture below shows an aggregation that will add a new **count** field.

![image](media://d0a6f1a8-164b-43e5-a56d-ed9ee0a6f6e6)

> ⚠️ Note that you must group your data before performing an aggregation operation, so the **Aggregate ** tab will not be visible if your data is not grouped.

The **Create field** tab includes buttons to filter the list of operations according to their case sensitivity. Some operations have a case sensitive and case insensitive version, so you can use these buttons to show only the version you need.

![image](media://936d1c67-2b8e-442a-a6dd-0d452764f372)

### (4) Filter and (3) Filter OR tabs

The **Filter **and** Filter OR** tabs contain different fields and options because a filter doesn't add a field; but rather the results of the selected operation performed on the selected argument(s) will be the inclusion or exclusion of rows from the query data. For example, the capture below shows a filter that will exclude (**negated**) records that contain a value in the **countMethod** field that is less than or equal to 150.

Just like the **Create field** tab, the** Filter **tab includes buttons to show only case insensitive or case insensitivity versions of those operations that have both options.

![image](media://160baa7f-d8d4-409a-8590-a2bfff0cf45c)

### (2) Group tab 

The **Group** tab contains a selector where you can choose the time period by which you want to group your data. Furthermore, you can also select **No-time-based** if you don't want to group by time. In the capture below we are grouping the data in the **uri** and **method** fields every 15 minutes.

![image](media://4b162dea-394a-466b-875c-13f8111a35ec)

In most of the tabs, you need to select an **Operation** from the drop-down list, then click **New argument** to activate the field where you identify the necessary arguments. These two fields are interdependent. That is to say, the system will automatically validate or reject certain arguments based on the operation you have selected. Similarly, the system will identify valid operations in green and invalid operations in orange based on any arguments you have selected. 

For example, the capture below shows that for the selected arguments, the operations that can be performed on that type of field are in green, while the invalid operations are shown in orange.

![image](media://4c846cb6-69a6-4840-ab5f-8ad3fc992796)

Each operation requires a specific number or type of argument(s). In some cases, you can also enter free text as an argument.

For more information about an operation's requirements, click the info** **icon next to the **Main operation** field.

This operation has only one format, but some others accept different combinations, which are always indicated in the information section (e.g. the [Rounding (round)](https://devodocs.atlassian.net/wiki/pages/createpage.action?spaceKey=LAD&title=Rounding%20%28round%29&linkCreation=true&fromPageId=49424537) operation has two different formats: **round(arg_1) → result** and **round(arg_1, arg_2) → result**). You can also check the number of arguments needed (in this case two) and the required format of the data you link to each argument (*string*, *integer*, *float*...).

## Progress bar

During the initial loading state, a progress bar displays the completion percentage of your running query. It will disappear once events are returned, or if the query yields no results, the message “There is no data to display” will appear.

![70_Build a query in the search window.png](media://e079154b-6e62-4c47-b6b8-3c71695dbe1f)

If your query remains at **0% completeness for 1 minute** and a warning or error notification appears, you should [review your query performance](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95206315) or [download your results](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95206208) asynchronously.

You can cancel your query at any time by simply clicking the **Cancel query** button.

### Restarting queries

When a query has been cancelled, you can modify and relaunch it from:

- [Query Editor](https://devodocs.atlassian.net/wiki/spaces/latest/pages/203882541)
- [Search window toolbar](https://devodocs.atlassian.net/wiki/spaces/latest/pages/204046417)

## Hints

- If you have too many or insufficient arguments, the system will automatically send you a warning message.
- If you haven't chosen the proper arguments, the system will automatically notify you.