Explorers and Worksheets help you navigate, analyze, and gain insights from you data in Observe by Snowflake.

Use the input picker to select the data source

Use the input picker to define the Dataset being read by the Explorer or Worksheet.

Queries match on the Dataset name, label, description, package, author, correlation tags, and column names. An exact name match ranks above a prefix, which ranks above a word that only appears inside a description or column. You can also scope the query using label:, name:, package:, author:, or column:, or wrap a phrase in quotes for a literal match. Matching text is highlighted, and if the hit is not in the name, the row says where it matched.

Select a Dataset from the list and view its details in the side panel to confirm that this is the Dataset you want to read from. In the example, the CloudTrail Events Dataset is selected, and you can view the details in the side panel.

If you arrived from another page, such as a Kubernetes resource, the tags that came with you appear under the search field. In this example, we have pivoted to this Log Explorer from a Dataset containing the correlation tag #k8s.cluster.name. Click on the input picker, then click the Filtered & sorted by pivot tags drop-down to view the required and related tags:

Datasets also containing the #k8s.cluster.name correlation tag are listed, ranked by how many of the other related tags they also carry.

Share a Worksheet or dashboard with other users

To share a Worksheet or dashboard with someone else, use the Share Page URL icon in the top right to copy a link to the clipboard. A URL copied from the browser address bar includes your current context and may not show the intended content. See URL query parameters for more detail on the Observe by Snowflake URL.

Select one of the options for handling time and data filtration when making a Share link:

• Filters & Current Time – The default behavior attempts to show the recipient exactly what is on the sender’s screen. Filters are set to be the same, and the time window is fixed to the start and end that are currently used. This share link will point at a specific window of time that is receding into the past.
• Filters & Relative Time – Using filters and relative time is designed for dashboard use. It shares the sender’s filters and sets the time window relative to the present. This share link will point at a different time window each time it is opened.
• No Filters & Time – This option removes all filtering and time decisions from the shared link; the recipient sets filters and selects their desired time window if the dynamic Observe by Snowflake default for that dataset is not ideal.

Understand the time window selection

Dashboards, Worksheets, and Explorers operate on a time window set by the time picker in the top right. Many of the options in that picker are relative to the present, such as “Past 15 minutes”, “Last week”, or “Since $DATE”. After your initial selection, the start and end times will transition to static points so that the data in the window does not change. For example, a dashboard with a time filter of “Past 15 minutes” on load will set start and end times, and after a few minutes will adjust the time display to show that the observed time is a fifteen minute window in the past.

Use live mode for low latency access to data

Log Explorer and Metrics Explorer offer Live Mode. When incident debugging requires the fastest possible access to data, Live Mode users can typically expect between 30 and 90 seconds of latency from source to screen, depending on data rate and agent configuration.

Auto-run queries in Worksheets and Explorers

In Worksheets and Explorers, normal usage involves changing the query. The newly produced query can be run automatically by checking the Auto-run button. When Auto-run is on, changes made with filtering tools cause the query to be reloaded immediately. When Auto-run is off, filter changes do not take effect until the user clicks Run.

Observe by Snowflake Administrators can control the default behavior of Auto-run.

Change the number of results displayed

By default, an events table shows the first 1000 rows of results. You can change the number displayed in the Limit tab of the Table Controls menu.

Hide, show, or reorder columns

Use the Columns tab to show or hide columns, and drag to reorder.

Use the filter bar to view specific data

Click in the filter bar and use the help to craft a query to narrow the scope of the data you are viewing your Explorers and Worksheets.

In the filter bar, you can perform tasks such as:

• Express complex boolean logic.
• Introduce OPAL functions.
• Use autocomplete for fields, values and JSON paths.
• Keep filters synchronized across the filter bar and other parts of the Observe by Snowflake interface.

Here is an example using boolean logic to look for events containing error in the body, or the stream is stderr, in the k8s.observeinc.com cluster:

You can see the k8s.observeinc.com cluster in the left rail is automatically selected since we specified this condition in the filter bar.

Start typing in the filter bar, and the autocomplete shows you suggestions for correlation tags, fields, values, functions and JSON paths based on the current input and page context: