RUM Search

RUM Search

Search syntax

A query is composed of terms and operators.

There are two types of terms:

  • A single term is a single word such as test or hello.

  • A sequence is a group of words surrounded by double quotes, such as "hello dolly".

To combine multiple terms into a complex query, you can use any of the following Boolean operators:

ANDIntersection: both terms are in the selected views (if nothing is added, AND is taken by default)
ORUnion: either term is contained in the selected views
-Exclusion: the following term is NOT in the view


Use the search bar’s autocomplete feature to complete your query using existing values:

To search on a specific attribute, first add it as a facet and then add @ to specify you are searching on a facet.

For instance, if your facet name is url and you want to filter on the url value, enter:

Escaping of special characters

Searching on a facet value that contains special characters requires escaping or double quotes. The following characters are considered special: ?, >, <, :, =,", ~, /, and \ require escaping with the \ character.

The same logic is applied to spaces within views facet names. Views facets should not contain spaces, but if they do, spaces must be escaped. If a facet is named user.first name, perform a facet search by escaping the space: @user.first\ name:myvalue.


To perform a multi-character wildcard search, use the * symbol. For instance, @http.url:https:\/\/* matches every view that has a URL starting with https://.

Numerical values

Use <,>, <=, or >= to perform a search on numerical attributes. For instance, retrieve all views that have a duration over 100ns with:


You can search for numerical attribute within a specific range. For instance, retrieve all your views with a duration between 100ns and 300ns:

@duration:[100 TO 300]


Searches all views containing /api/v1/test in the attribute http.url_details.path.
Searches all views containing a value in http.url attribute that start with /api/v1/.
@duration:[100 TO 300] @http.url_details.path:\/api\/v1\/*
Searches all views with a duration between 100 and 300 ns, and containing a value in http.url_details.path attribute that start with /api/v1/.

Further Reading

Additional helpful documentation, links, and articles: