Searching for Metrics: Advanced Methods

Watch this video to learn how to search and understand your metrics over time.

The topics covered in this article are:
Overview of How Search Works
Search by Origin
Property-based search
Raw search


  • The user builds a search expression by combining multiple tokens, each of which may be in property-based or raw search format.
  • As user starts typing the filter in the expression node, the search engine tries to autocomplete the expression with matching keys and corresponding values. Several options are automatically presented for keys and values.
  • If matching properties are not found for a token, the engine automatically adds the ‘search:’ prefix and builds a raw search token.
  • If the user accepts the token by pressing the ENTER key, the search engine also lists relevant property values for selection.
  • An example of a completed search filter might look like “search:1234, host:web01, region:us…”
  • For metrics in format 1.0, the engine automatically adds the position property (pos1=value1) to the token search filter, for example, “pos1:staging pos4:us search:feed”.

The two token search formats, property-based and raw, can be combined in any search for metrics.


  • Autocomplete only shows the first 100 property names or values. If you do not see the properties or values that you need, first narrow the metrics using another token to form an expression subset.
  • Boolean operators are only valid within a property value or raw search and not between properties. See the examples below.


Metrics originating from Data Streams, Alerts and Composite Metrics can be included in metric expressions. To search for metrics by their origin:

  1. Click in the expression node box.
  2. Enter @, to display the Origins drop-down menu.
  3. Select an Origin.
  4. To continue refining the metric expression, select properties or property value pairs.

    Note: To view the originating stream summary/edit alerts window/ view composite window of a specific metric, in the metrics legend click @[stream/alert/composite] of the metric for which you want to see the details.


A property-bases search looks at metrics that consist of specific combinations of key and value. The search value can be built out of composite expressions or partial values.

  • Supports:
    • Wildcards (*)
    • Boolean operators – AND, OR, NOT or minus sign (-)
    • Search format: property_key:value.

To perform property-based search:

  1. Click in the expression node box. A drop-down list of properties and property-value pairs (All values) opens.
  2. In the list, select a property and then a value, such as All(*), a specific value, or a logical expression; or select a property-value pair (token):

    Property-value pairs appear in the All Values section:

    Selecting from the list completes the entry. For example:

    “property1:(US AND UK) property 2:(US*) pos3:\a{3}b{3}\”

A raw search is a free-form search that looks at metrics that contain the typed characters anywhere in either the property name or the value.

  • Supports:
    • Wildcards (*)
    • Regular Expressions
    • Boolean operators – AND, OR, NOT or minus sign (-)

To perform raw search:

  1. In the expression node box, start typing the property key or value. The drop-down list shows all properties and values which contain the typed characters:
  2. If you choose a token (property-value pair) from the list, it is entered in the expression node as is.
  3. If you choose just a property from the list, it is entered in the expression node followed by a colon (:) indicating that a value for the property is expected next.
  4. If you press ENTER, the search string is entered in the expression node preceded by ‘search :’, for example: ‘search : ar”.


    “NOT (b* OR c*)” becomes “search: NOT (b* OR c*)” after pressing ENTER.

    “search:(US AND UK), search:(US*), search:\a{3}b{3}\” 

An example of a metric expression containing both types of searches is:

Note: The number shown in the search expression box indicates the number of metrics returned from the search.

Was this article helpful?
2 out of 2 found this helpful