Cortex Data Lake

helps you build queries by offering suggestions as to what you can specify next in your query. You can select field names, boolean operators, and equality and pattern matching operators as you build your query. You can also use type-down to specify field names and operators. Finally, you can left-click on a table cell to add that column and value, with an equality operator, to the query.

For example, click into the query field to see the list of available field names:

You can either click to select the field that you want, or type down until you find the right field:

The user interface immediately displays the operators that are appropriate for the field's data type:

Long queries wrap to the next line.

Continue this point-click-and-type activity until your query is complete. Then click or press Enter to retrieve log records.