Click to filter

Almost every visible value on a result row is clickable. Click one and that value becomes a filter in your SOQL search, narrowing the result list.

This is the fastest way to drill into an investigation. You rarely need to type a query by hand once you have results on screen.

What you can click

On a collapsed row:

• Event name (the chat_rate_limit_hit style identifier)
• Actor (e.g., player:CharlesSmith)

On an expanded row:

• Every key in the payload list, including all payload.* entries
• The canonical fields at the top of the payload (severity, event, actor, source, message, dataset)

On the facets sidebar:

• Any value in the SEVERITY, DATASET, or SOURCE breakdown

On the timeline:

• Click a bar to filter to events inside that minute (or whatever the bucket size is)
• Drag across multiple bars to filter to a custom range

What gets added to the query

The exact filter depends on the field type:

• severity values use the unquoted form: severity:warn. Severity is a known enum so this is the canonical form.
• All other fields use double-quoted strings: actor:"player:CharlesSmith", dataset:"player-actions", payload.player:"CharlesSmith". Special characters inside the value get escaped automatically.

The new filter is appended to your current query with AND. So clicking actor:player:CharlesSmith while your query reads severity:error produces:

severity:error AND actor:"player:CharlesSmith"

If your query was empty, the click sets it as the seed predicate (no leading AND).

Undoing a click

The toolbar has a ← BACK button that steps backwards through the queries you ran. One click takes you back to the previous query. See Back button.

Tips

• Stack filters quickly. Click a severity, then an actor, then a dataset. Three clicks turns "100 events" into "the 3 events you care about".
• Read the URL after each click. The active query is in ?q=..., so you can copy the URL at any point to share or bookmark.
• Use [click to filter] with the timeline. Run a query, see a spike on the sparkline, click the spike bar to drill into that minute, then click an actor to pin it.

What it does not do

• Clicks do not REPLACE the current query (they append). To start over, clear the search bar manually.
• Clicks do not change the time range. The picker at the top right controls that separately.
• Clicks on the same value twice produce two identical clauses. SOQL is happy with the redundancy but you can clean them up by hand if you want a tidy URL.