Using Live Mode in Logs Explorer

Note

Only customers with usage-based pricing can access this feature.

You can click Live Mode when viewing logs and see your logs stream into Observe. Filter your logs and generate visualizations that continuously update with new data.

Figure 1 - Enabling Live Mode

Since Live Mode increases your credit usage, you may want to disable it unless actively working on troubleshooting an ongoing issue. Live Mode automatically becomes disabled after 15 minutes. Using the Time Scrubber feature also automatically disables Live Mode.

For Log Explorer, you can select from 5 minutes, 10 minutes, or 15 minutes.

When you enable Live Mode, and click the Query icon, you see information about the query similar to the following image.

Figure 2 - Live Mode Query Details

Latest data received - the time that data required for the query most recently arrived on the Observe instance but has not yet been processed.

Latest data available to query - the latest system time at which new data was processed and became available for Observe to query it. Live Mode users can typically expect between 30 and 90 seconds of latency from source to screen, depending on data rate and agent configuration.

These two status messages may have slightly different times as the first one designates the time that the data required for the query most recently arrived on the Observe instance but has not yet been processed. The second message designates the time the data became available for Observe to query it.

To learn more about monitoring and controlling usage cost, see Credit Manager.