Use or modify a saved log data search in Health Log Analytics

---
title: Use or modify a saved log data search in Health Log Analytics
description: Use a saved search of log data to better understand the causes of an alert. As the owner of a saved search, you can modify the search values and save your changes.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/it-operations-management/health-log-analytics/hla-op-search-queries-saved-sow.html
release: brazil
product: Health Log Analytics
classification: health-log-analytics
topic_type: task
last_updated: "2026-09-10"
reading_time_minutes: 2
keywords: [saved searches, load search, modify search, manage searches, search ownership, update search values, discard changes, search results, Results over time chart, column filters, assignment group access]
breadcrumb: [Review alert-related logs on the Log Viewer, Analyzing and resolving alerts, Health Log Analytics, ITOM AIOps, IT Operations Management]
---

# Use or modify a saved log data search in Health Log Analytics

Use a saved search of log data to better understand the causes of an alert. As the owner of a saved search, you can modify the search values and save your changes.

## Before you begin

**Note:** If you're not the owner of the saved search, save the search with a different name. You can then update search values, save your changes, and share the search with others.

Role required: evt\_mgmt\_operator or evt\_mgmt\_admin

## Procedure

1.  Open the **Log Viewer** using one of the following methods:

    -   Navigate to **Workspaces** > **Service Operations Workspace** and select the Log Viewer icon \(\[Omitted image "icon-log-viewer-sow.png"\] Alt text: Log Viewer icon.\).
    -   While viewing log entries for an alert on the **Surrounding logs** tab, select **Log Viewer**.
2.  Use a saved search.

    1.  Select the selection icon \(\[Omitted image "icon-selection-sow.png"\] Alt text: Selection icon.\) and then select **Load search**.

    2.  In the Load search dialog box, select the name of the search to load.

    The system returns the full list of log lines that match the search values and displays the information in the Results over time chart.

3.  Update the saved search.

    1.  Select the selection icon \(\[Omitted image "icon-selection-sow.png"\] Alt text: Selection icon.\) and then choose **Manage my searches** from the drop-down list.

    2.  Modify the settings.

<table id="table_ctn_5gg_ftb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Name

</td><td>

Name of the saved search.

</td></tr><tr><td>

Query

</td><td>

Search query.The Log viewer uses the Elasticsearch search engine, so you can use any supported search term structure in the **Query** field.

</td></tr><tr><td>

Assignment group

</td><td>

Assignment groups that can access the search. The members of the groups can use the search.

</td></tr><tr><td>

Filter

</td><td>

Column filter in standard format \(`field1=value1, field2=value2, field3=value3, ...`\).

</td></tr><tr><td>

Updated

</td><td>

Date and time the search was updated.This feature is supported in the Health Log Analytics application, Version 20.0.11 - July 2021, and the Health Log Analytics Viewer application, Version 20.0.4 - July 2021, available from the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home).

</td></tr></tbody>
</table>        To revert changes you have made to the search values, select the selection icon \(\[Omitted image "icon-selection-sow.png"\] Alt text: Selection icon.\) and then select **Discard Changes**. The changes that you made to the search values are discarded. You can continue to update the search settings.

    3.  Save the updated search.

        1.  Select **Save as**.
        2.  In the **Search name** field, specify a unique and descriptive name for the search and then select **Save**.