The Query Library#
The query library lets you store commonly-used search queries for quick recall. You can pull up queries from the library at the Gravwell search prompt and embed them in dashboards.
The Query Library Page#
You can access the query library management page from the main menu, in the “Searches” section:
The page displays tiles for all the user’s stored queries:
Creating a Query#
There are two ways to create a new entry in the query library: by storing a search you have run, or by filling in a form on the management page.
Save query from search#
When you have run a manual search and decide you want to save that query for later, you can select ‘Save query’ from the search results menu:
The GUI will bring up a dialog prompting for a name and description of the query to be saved:
Once you fill in the name and description and click Save, the query will be available in the query library.
Add query manually#
You can also add a query to the library manually, by clicking the ‘Add’ button in the upper right corner of the query library management page. You will be presented with a page prompting for a query string, name, and description, plus some optional fields (labels, etc.)
Running a Query#
You can run a query by clicking the search icon on the query’s tile in the query library page. The UI will prompt for a timeframe; once you select a timeframe, the search will be launched:
The queries stored in the query library are also available through the search bar. Click the list icon on the far-right side of the search bar as when accessing search history, then click “Query library” at the bottom of the dropdown to switch views. You can now select from the entries in your query library:
Scheduling a Query#
You can easily create a scheduled search from a query library item by selecting the “Schedule” option in the extended menu. This will take you to a scheduled search creation page with the selected query pre-populated; fill in the the name, description, schedule, etc. and click ‘Save’ to create a scheduled search.