Create New Tails
- On the main toolbar, click Tail.
- Select Configure New Tail, and then click Next.
- Select which source to query from the following options:
- All available Log Sources. All log sources available to your user account will be queried.
- Selected Log Source Lists. Select which Log Source Lists to query from the grid that appears.
- Selected Log Sources. Select which Log Sources to query from grid that appears.
- Click Next.
Select an option from the Add New Field Filter. For detailed instructions on adding filters, see Use the Filter Editor.
The User (Impacted/Origin) by Active Directory Group filter is only available to Global Administrators and Global Analysts. Restricted Analysts and Restricted Administrators may not create or edit a User (Impacted/Origin) by Active Directory Group filter.
- Click Next.
- Select the log repositories to include in the query:
- Query the Platform Manager. Select this option to include the Platform Manager database in the query.
- Query all default Log Repositories. Select this option to include all default Log Repositories in the query.
- Query the following Log Repositories. Select this option to choose the Log Repositories you want to include in the query. The list of Log Repositories becomes active and you can select the check boxes of the repositories you want.
- In the Settings section, configure the following settings:
- History to load. How much previous history should be loaded (up to 1 week).
- Refresh Rate. How often new logs should be queried for (between 1 and 60 seconds).
- Query timeout. How long the query can run before it times out (between 5 and 3,600 seconds).
- Aggregate log cache size. How many aggregate logs to store in memory (between 1,000 and 10,000).
- Log cache size. The number of individual logs to cache in memory (between 1,000 and 10,000).
- Include raw log in query results. Check to include the raw logs in the query results.
- Click Next.
- (Optional) Save this Tail so you can use it again without doing all the set up:
- Type a name and description.
- Select the Permissions.
User Type Read Access
User Type Read Access Rights Global Administrator - Public Global Administrator
- Public Global Analyst
- Public Restricted Admin
- Public Restricted Analyst
- Public All Users Private
Global Analyst - Public Global Analyst
- Public Restricted Admin
- Public Restricted Analyst
- Public All Users
- Private
Restricted Administrator - Public Restricted Admin
- Public Restricted Analyst
- Private
Restricted Analyst - Public Restricted Analyst
- Private
User Type Write Access
User Type Read Access Rights Public All Users - Private
- Public All Users
- Public Global Administrator
- Public Global Analyst
- Public Restricted Admin
- Public Restricted Analyst
Private - Private
- Public Global Administrator
Public Global Administrator - Private
- Public Global Administrator
Public Global Analyst - Private
- Public Global Administrator
- Public Global Analyst
Public Restricted Admin - Private
- Public Global Administrator
- Public Global Analyst
- Public Restricted Admin
Public Restricted Analyst - Private
- Public Global Administrator
- Public Global Analyst
- Public Restricted Admin
- Public Restricted Analyst
- Set the Record Type.
- (Optional) Configure Intelligent Indexing.
- Select Enable Intelligent Indexing.
- Select Enable Expiration.
- Click Save.
- To start the query, click Next.
The Tail viewer shows an Aggregate Log/Event Listing and a Log/Event list on the same screen. Both lists update in real-time.
