Defining a search filter app
JDBC URL
2. Select the Database Connection that you want to delete and click Delete
3. Click OK
Creating the search filter app
You can create the search filter app to create a customized search query in IBM Operations Analytics -Log Analysis.
About this task
To create a search filter app:
Procedure
1. SearchFilter definition: Use this app definition to define your own search filter:
{ "name": "Example app for search filter", "description": "Example app for search filter", "customLogic": {
"script": "searchFilter.sh",
"description": "Example app for search filter", "parameters": [
{
"name": "relationalQuery", "type": "relationalQuery", "value": {
"dataSource": {DATASOURCE_DETAILS}, "SQL": "SQL_QUERY"
} }
], "output": {
"type": "searchFilters", "visualization": { "searchFilters": {}
} } } }
2. Update the dataSource field with your datasource details.
For example:
"value": {
"dataSource": {
"schema": "ITMUSER",
"jdbcdriver": "com.ibm.db2.jcc.DB2Driver", "jdbcurl": "jdbc:db2://9.12.34.56:50000/WALE", "datasource_pk": 1,
"username": "itmuser", "password": "tbsm4120", "name": "datasource"
},
3. Update the SQL field with your query.
For example:
"SQL": "select * from ITMUSER.test_OLSC"
Results
After you run the app, the customized search is displayed in the configured pattern section of the user interface and the data source and time filters are set. The keywords, if any, and the count information are also displayed.
Note:
1. If the app output contains data sources, the values that match the search criteria are returned on the user interface. If no data sources are returned, the existing selections are retained and used.
2. If the app output contains time filters, the values that match the search criteria are returned on the UI.
If no time filters are returned, the existing selections are retained and used.
3. If the app output contains keywords, IBM Operations Analytics searches the data sources and time filters that are returned and displays the keywords and the search hit count in the configured patterns widget UI.
Example
The following code example demonstrates the logic that is used for the search filter app:
{ "name": "Sample Search filter app",
"description": "App for getting search filter", "customLogic": {
"script": "searchFilter.sh",
"description": "App for getting search filter", "parameters": [
{
"name": "relationalQuery", "type": "relationalQuery", "value": {
"dataSource": {
"schema": "ITMUSER",
"jdbcdriver": "com.ibm.db2.jcc.DB2Driver", "jdbcurl": "jdbc:db2://9.12.34.56u:50000/WALE", "datasource_pk": 1,
"username": "itmuser", "password": "tbsm4120", "name": "datasource"
},
"SQL": "select * from ITMUSER.test_OLSC"
} } ],
"output": {
"type": "searchFilters", "visualization": { "searchFilters": {}
} } } }
Note: The output > visualization sub parameter must be set to searchFilters.
The search filter app uses relationalQuery as the input parameters. The relational query is a JSON object that consists of the following JSON keys:
• dataSource is the value of the data source key that defines database connection attributes such as JDBC connection details, schema name, user credentials .
• SQL is the value of SQL key that defines the query that we want to run against the database
Note: If you are trying to run search filter against a data source registered with IBM Operations Analytics, you can provide dataSource name instead of dataSource details. All details of the corresponding
dataSource are fetched from IBM Operations Analytics. The dataSource is created with the Database connections option in the Data Sources workspace.
{ "name": "relationalQuery", "type": "relationalQuery", "value": {
"dataSource": "myDataSourceName", "SQL": "select * from MYDB.MYTABLE"
} }
where myDataSourceName is the name of a data source that is defined in IBM Operations Analytics - Log Analysis.
Related concepts Application files
The application file JSON can be created by implementing the structure provided in the sample JSON outlined in this topic.
Data elements
There are three parameters required for data elements:
id Specify an identifier for the data element. The Custom Search Dashboard uses this value to determine the data that is displayed. The Custom Search Dashboard uses this value to determine the data that is displayed for a particular chart.
fields
Specify an array containing field descriptions. Each field that you specify in the array has an ID, a label, and a type.
rowsUsing the rows array to specify a value for each of the fields that you have specified.
HTML elements
There are two parameters required for HTML elements:
id Specify an identifier for the data element. The Custom Search Dashboard uses this value to determine the data that is displayed. In the application file, the chart specifications use this id to specify the data element used for the chart.
htmltext
Specify the HTML that you want to display. A HTML portlet is used to display the HTML that you specify.
Example
This is a sample JSON output which contains both the types of output which contains both chart data and HTML output:
{ "data":[
{
"id":"ErrorsWarningsVsTime", "fields":[
{
"id":"timestamp", "label":"Date", "type":"TEXT"
}, {
"id":"severity", "label":"severity", "type":"TEXT"
}, {
"label":"count",
"htmltext":",<!DOCTYPE html><html><body><div><h1>Sample HTML</h1>
</div></body></html>"
} ] }
In this example, the data id ErrorsWarningsVsTime is defined in the script.
chartdata.append({
'id':'ErrorsWarningsVsTime', 'fields':facetFields, 'rows':facetRows})
In the application file chart specification, the id ErrorsWarningsVsTime is referenced to specify the data set used in the chart.
Launching a new context tab in a HTML Custom Search Dashboard
You can provide a link within a HTML Custom Search Dashboard that launches a URL in a new tab within the Custom Search Dashboard. The search or Custom Search Dashboard is executed with the context parameters that you specify in the URL.
This example contains the URLs to launch searches with search parameters within a Custom Search Dashboard:
{ "id": "htmlData",
"htmltext": "<!DOCTYPE html><html><body><br><div>
<a href=http://www.espncricinfo.com//>Normal URL - - ESPN Cricinfo</a>
</div><br><div><a href=https://192.168.56.101:9987/Unity/CustomApps UI?name=All%20Supported%20Visualizations&appParameters=[]>Custom App LIC
- - All Supported Visualizations</a></div><br><div><a href=https://192.168.56.101:99 87/Unity/SearchUI?queryString=diagnosticLevel:==Warning&timefilters=
{\"type\":\"relative\",\"lastnum\":\"1\",\"granularity\":\"year\"}&d ataSources=[{\"type\":\"datasource\",\"name\":\"/DB2Diag1\"}]>Sear ch UI LIC - - DB Log Events with Diagnostic Level - Warning</a></div>
<br><div><a href=https://192.168.56.101:9987/Unity/SearchUI?querySt ring=diagnosticLevel:==Severe&timefilters={\"type\":\"relative\",\"la stnum\":\"1\",\"granularity\":\"year\"}&dataSources=[{\"type\":\"datasour ce\",\"name\":\"/DB2Diag1\"}]>Search UI LIC - - DB Log Events with Diag nostic Level - Severe</a></div></body></html>" }
Note: Any spaces that are required in your URL must be escaped. If you want to include a % character in your URL in must be added as %25.
Template-based search filter Custom Search Dashboard
A template has been provided for search filter Custom Search Dashboards. This template is located in the
<HOME>/IBM/LogAnalysis/AppFramework/Templates/SearchFilters directory.
To use this template, you must specify the template name in the type field:
{ "name": "Sample Search filter app", "type":"SearchFiltersTemplate",
"description": "App for getting search filter", "customLogic": {
"script": "searchFilter.sh",
"description": "App for getting search filter", "parameters": [
If you use this template, the application directory for this application requires the application file only.
You do not need to copy the .sh and JAR script files into the application folder.
Modifying the search filter app core logic
If you want to extend the default implementation, the core logic of the search filter app is described here.
Procedure
1. Create a connection to the datasource or database that you specified in the input file using the Data Sources workspace.
2. Run the SQL query that is part of the input file for the app.
3. Tokenize the output of the SQL query and remove common words such as verbs.
4. Pick out the timestamp column and pick up startTime as minimum timestamp and endTime as maximum timestamp.
5. If you already know the data source against which you want to use this search filter, you can use the logsource name in the output parameters. If you do not know this, use an asterisk (*).
6. Construct output in the JSON format. For example:
{ "keywords": [
"lastnum": 7,
"granularity": "day"
},
"logsources": [ {
"type": "tag", "name": "*"
} ] }
Note: The source code of the default implementation (in Java) of the search filter app is in included with IBM Operations Analytics - Log Analysis in the <HOME>/AppFramework/Templates/
SearchFilters directory. You can update the default implementation based on your requirements.
Related concepts Application files
The application file JSON can be created by implementing the structure provided in the sample JSON outlined in this topic.