Migrate to Unified Search Syntax

Note

Unified Search Syntax is available for tenants created after December 5, 2024. If your Observe tenant was created before this date and you want to enable the new Unified Search Syntax, please reach out to Observe for assistance. Use the in-product Contact Support button to contact Observe for more information. On the left side navigation menu, click Docs & Support, Contact Support, and Send Us a Message to contact an Observe Data Engineer.

If you have used a substring search previously (before December 5, 2024), your new substring search might return a slightly different result. Let’s suppose you have the following record in the log column.


"name":"errors","type":{"rep":"string"}

  • Old syntax: filter log ~ error matches the record above.

  • New syntax: filter log ~ error doesn’t match the record above anymore. Use filter log ~ error* or filter log ~ *error* to get the same result. Please review Substring Search to learn more.