Overview

Findings helps you capture, organize, and reuse important context during investigations in Log Explorer.

Use findings to collect evidence, compare results, and build context as your investigation evolves. Save findings as checkpoints so you can backtrack or return to useful queries and logs. Arrange findings to visualize and remember your investigation path, and add notes to findings to record what you observed. You can also use findings as context to Ask Bits, or add them to a Notebook for a report to share with others.

Save log lines, visualizations, and queries as Findings with the Add Finding button or the Cmd/Ctrl + S keyboard shortcut. Double-click or use Open in Explorer to return to findings in the Log Explorer. Branch into new questions without losing track of earlier observations or investigative paths.

Findings panel

Findings appears in the side panel on the left of Log Explorer. To open it:

1. Navigate to Log Explorer.
2. Click the Findings tab on the top left.

The Findings panel is where you work with findings: arrange them, reopen them in Log Explorer, and select them to send elsewhere. The panel keeps the findings and their layout across page reloads and browser sessions until you delete them.

Capture a finding

Add a finding from anywhere in Log Explorer by pressing Cmd/Ctrl + S. This captures the query, the page to return to, and the absolute time range you were viewing. To rename the default title, click Edit in the upper right corner of the finding card in the Findings panel. You can also add notes to each finding at the bottom of the finding card.

Queries and visualizations

In the toolbar above your results, click the Add Finding button, or press Cmd/Ctrl + S. You can also click Add current page as a finding in the Findings panel.

The Add Finding button appears in the same place for every visualization.

The finding stores your search query, time range, and visualization, including any group-by and aggregation you configured.

Individual log events

Click a log event in your results to open the log side panel. Hover over the Log Message section and click the Add a finding button, or press Cmd/Ctrl + S. This captures the whole log event side panel to return to later.

Capturing the log event also captures the query that produced the log side panel. Returning to the finding reopens the log side panel with the corresponding query in the background.

Specific text in a log message or attributes

To capture part of a log message, select the text in the Log Message section and press Cmd/Ctrl + S. You can also select Add Finding from the context menu that appears with the selected text.

To capture attribute values, select the text and press Cmd/Ctrl + S.

In both cases, the finding stores the text you selected. You can use the finding to return to the log event side panel.

Return to a finding

Double-click a finding to return to it in Log Explorer, or hover over the finding and click Open in Explorer. Log Explorer reloads the query, time range, and visualization that the finding was captured with.

Each finding keeps the query and absolute time range. In Log Explorer, you can change your search as often as you need. Return to any earlier finding without rebuilding the query.

Send findings to Bits AI and Notebooks

Select one or more findings to act on them together:

• To ask Bits Chat about them, type your question in the selection bar and click Ask Bits. You can also click Ask Bits in the menu at the bottom of the Findings panel after selecting the findings. Bits Chat opens with the selected findings attached as context.
• To add findings to a Notebook, click Open in Notebooks. Choose a new or existing notebook.

Send only the findings that relate to your question. For example, if three of the eight findings in your panel cover the error you’re asking about, select those three. Notes on findings are also sent.

Organize your findings

Drag a finding to move or resize it. Datadog saves the layout you build, so the organization looks the same the next time you open the panel.

To reset your organization, use the auto-organize option, which groups findings by the query they came from. If you made different visualizations from the same query or saved specific log lines from that query, those findings are grouped together. Moving, resizing, or deleting a finding removes the visual grouping indication in the background.

Delete findings

To delete one finding, hover over it and click the delete button in the upper right corner of the card. You can also select the finding and press the Delete key. To delete several at once, select them and press Delete. To select every finding, press Cmd/Ctrl + A.

The clear all button in the Findings panel deletes all findings.

To restore a finding after deleting it, click Undo in the message that appears, or press Cmd/Ctrl + Z.

Keyboard shortcuts

Further reading

Additional helpful documentation, links, and articles:

Search and analyze your logs in Log ExplorerDOCUMENTATION Automatically configure your Log ExplorerDOCUMENTATION Ask questions about your data with Bits AI chatDOCUMENTATION Build and share investigations with NotebooksDOCUMENTATION