# Get started with explore logs

This quickstart walks you through a complete investigation flow in Explore — from selecting a data source to drilling down into specific log entries. Follow the steps in order to get familiar with the key features.

## Step 1: Open Explore

Navigate to **Explore** from the Coralogix main menu.

Explore opens with the default view: an empty query, the `logs` dataset selected, and the time range set to the last 15 minutes.

## Step 2: Select your data source

Use the dataset selector at the top of the screen to choose the dataset you want to query.

- Select `logs` to query your ingested log data (default).
- Select `spans` to query distributed tracing data.
- Select a system dataset to query Coralogix-managed metadata.

For this quickstart, keep the default `logs` dataset selected.

For more information, see [Select a data source](https://coralogix.com/docs/user-guides/data_exploration/datasets/index.md).

## Step 3: Set the time range

Use the time range control to set the window for your search.

1. Select the time range control (top-right area of the screen).
1. Choose a preset such as **Last 1 hour**, or enter a custom range.
1. Confirm your selection.

Results and the Fields panel update to reflect the selected time range.

## Step 4: Run a search

Use the search bar to filter the logs you want to investigate.

1. Select the search bar.
1. Type a Lucene query. For example: `coralogix.metadata.severity:"Error"`
1. Use the autocomplete suggestions to select fields and values without typing the full path.
1. Select **Run**.

Results appear in the logs grid below.

For more information, see [Search logs and spans](https://coralogix.com/docs/user-guides/data_exploration/search/index.md).

## Step 5: Filter with fields

Use the **Fields** panel on the left to narrow your results further.

1. Open the **Fields** panel.
1. Find a field you want to filter on (for example, `coralogix.metadata.applicationName`).
1. Expand the field to see its value distribution.
1. Select a value to add it as a filter.
1. Select **Run** to apply.

The filter appears in the query bar. The Fields panel and query bar stay in sync — changes in either place are reflected in the other.

For more information, see [Filter with Fields](https://coralogix.com/docs/user-guides/data_exploration/fields/index.md).

## Step 6: Group and aggregate results

Use the Query Builder to move from raw log rows to grouped summaries.

1. Select **Group by** and choose a field (for example, `coralogix.metadata.severity`).
1. Select **Aggregation** and choose **count**.
1. Select **Run**.

The results table changes from individual log rows to grouped rows with a count for each severity level.

For more information, see [Query Builder](https://coralogix.com/docs/user-guides/data_exploration/query_builder/index.md).

## Step 7: Visualize the results

Switch to a chart to see the distribution over time.

1. Above the results panel, select the **Visualize as** dropdown.
1. Select **Vertical bar chart**.

The chart updates to show log counts grouped by severity over your selected time range. Select any bar segment to drill down into the underlying logs.

For more information, see [Visualize log data](https://coralogix.com/docs/user-guides/data_exploration/visualize/index.md).

## Step 8: Inspect a log entry

Select any row in the logs grid to open the log details panel.

1. Switch back to the **Table** view using the **Visualize as** dropdown.
1. Select any log row in the results.
1. The log details panel opens on the right.

From the panel you can:

- Review all fields for the selected log entry.
- Use field-level actions to include or exclude values in the query.
- Navigate to adjacent log entries using the arrow controls.

For more information, see [Log details panel](https://coralogix.com/docs/user-guides/data_exploration/logs/info_panel/index.md).

## Additional queries

Try these queries to explore more of what Explore can do:

Filter for logs where a specific field exists:

```text
_exists_:cx_rum.page_context.page_fragments
```

Filter for logs from a specific application:

```text
coralogix.metadata.applicationName:"production"
```

Combine conditions:

```text
coralogix.metadata.severity:"Error" AND coralogix.metadata.applicationName:"production"
```

## Navigate back

Use the browser back button or the main menu to navigate away from Explore. Your current tab configuration is not saved automatically — use **Save view** from the Explore actions menu before navigating away if you want to return to this configuration.

For more information on saving and managing views, see [Explore tabs, views, and queries](https://coralogix.com/docs/user-guides/data_exploration/views_queries/index.md).

## Next steps

Turn query results into charts and tables in [Visualize logs](https://coralogix.com/docs/user-guides/data_exploration/visualize/index.md).