Link
Search

Discover Search Guide

A saved Discover search lets you reopen a data source, query, filters, and table columns. You can also select it when creating a monitor.

  1. Open Logs > Discover and choose the data source you want to search.

    Discover with the data source selector open above the field list on the left.

    Select the data source from the dropdown above the field list on the left side of Discover.

  2. Select a time range containing events from that source.
  3. Add the query and field filters you need. Select Update after changing the query; Refresh reruns an unchanged search.
  4. Add useful fields to the results table and confirm that the returned events match your intended conditions.

For example, the screenshot uses the duo-security source, the DQL query event.action: authentication, and an enabled filter for event.outcome is denied. Only the event action and outcome are displayed alongside the timestamp. Choose fields and values that exist in your own data source.

Discover with an authentication query, a denied-outcome filter, and populated results.

  1. Select Save in the top toolbar to open Save search.
  2. Enter a descriptive Title, such as Documentation demo - denied sign-ins.
  3. Select Save. Use Cancel to discard the draft.

The Save search dialog with a fictional example title.

The toolbar’s Save stores a Discover search. The small save icon inside the query bar opens Saved Queries, a separate feature for reusing query text and optional filters. Use the toolbar control for the saved search you will select in a monitor.

  1. Select Open in the Discover toolbar.
  2. Enter a title or part of a title in the search bar to filter the list.
  3. Click Title at the top of the list to sort saved searches in ascending or descending order.
  4. Select a saved search from the list to apply it to the Discover view.
  5. To update a search, make your changes and select Save. Review the save dialog before replacing an existing search or saving a copy.

Open Saved Search filtered to Duo searches, with a Delete action for each row.

The interface includes a Delete action for each saved search. Before removing one, check whether a monitor, dashboard, or report uses it. Closing the Open panel does not delete anything.

Use the search in a monitor

Select Alerts in the Discover toolbar to open Events > Monitoring. Select Create monitor, then choose the saved search in the monitor editor. Set the monitor’s evaluation window and trigger conditions before saving it.

Follow the Create a Monitor Guide for the full workflow. To start with a built-in template or configure notifications, use the Alert and Template Guide.

Additional information

  • Keep queries and filters specific enough to identify the events you want the monitor to evaluate. Table columns control what Discover displays; adding a column does not create a filter.
  • Check the source and time range when Discover returns no events. The source must still exist when the saved search is opened or selected in a monitor.
  • If a monitor’s saved-search selector does not load, check for saved searches whose data sources have been removed and contact your administrator. A blank selector is not evidence that your Discover search was never saved.
  • Review the query language, field filters, and table fields sections for more detailed examples.

Return to How to Guides