Live Search

Looking for a specific request or response condition? With Live Search you can filter requests within a bucket that match a specified keyword or attribute value. You can also mix and match keywords and attribute values in a single query to help narrow your results even further.

Search results streams are updated in real-time as new requests are made that meet the specified query criteria.

Live Search is available to accounts on a paid subscription plan.

• Keyword Searches
• Wildcard Searches
• Attribute Searches
• Negating Terms
• Advanced Search Queries

---

Keyword Searches

Searches for keywords will return requests with exact matches for that keyword. When multiple keywords are specified the results will include requests that match all supplied keywords. You can search for an exact phrase by putting the phrase inside quotation marks.

phone	Search for requests matching the word "phone".
phone number	Search for requests matching the word "phone" and the word "number".
"phone number"	Search for requests matching the phrase "phone number".

---

Wildcard Searches

You can use the wildcard * to match any substring in your search term, or ? to match a single letter. Wildcards do not work in numeric fields. You can use more than one wildcard in a search term, but your search term cannot begin with a wildcard. Here are some examples:

/users/*/messages	Search messages sub-resources for any matching user ID.
book*	Search for requests including any term beginning with book, which would include book, books, and booking.
dr?ft	Search for requests with terms like draft and drift.
b?ok*	Search for requests containing terms matching the pattern, such as book, books, and broken.
status:4*	Not allowed: numeric search fields cannot contain a wildcard.
*aft	Not allowed: search terms cannot begin with a wildcard.

---

Attribute Searches

In addition to searching by keyword, you can also search for requests with specific attributes. Searches on numeric attributes can also use the numeric operators >, >=, <, and <=. The following attributes are supported:

method:POST	Requests made with a specific method.
status:400	Requests with a specific response status code.
status:failed	Requests that failed to connect to the remote server (timeout, network error, DNS resolution failed, etc).
host:api.yourapihere.com	Requests made to a specific hostname. Will match the domain provided and subdomains.
path:/api/v1/users	Requests made to a specific path. Will match the path provided and child paths.
scheme:https	Requests made to a specific scheme. Either http or https.
source:api	Requests that were received by Runscope using the given source. Valid value are dashboard, gateway, capture, passageway or api.
request_size<64	Requests that contained less than 64 bytes in the POST or PUT body.
response_size>1024	Responses that contained more than 1024 bytes in the response body.
response_time>=5000	Responses that took 5000 milliseconds (5 seconds) or more to complete.

You can use wildcards in attribute searches as well. For example, method:P* would match both POST and PUT.

---

Negating Search Terms

You can search for requests that don't match a search term by using a negation operator at the beginning of your search. To negate a search term, add NOT, -, or ! before your search term (all are interchangeable). Here are some searches that can be performed with negation:

NOT users	Search for requests that don't match the keyword users.
!users	Search for requests that don't match the keyword users.
-users	Search for requests that don't match the keyword users.
!status:200	Search for requests that have a status code other than 200. This is equivalent to !status==200.

---

Advanced Search Queries

To build more complex searches, you can use the Boolean operators AND, OR, and NOT in your searches. You can also use parentheses to group your searches into expressions. Here are some examples:

method:POST OR method:GET	Requests made with either the GET or the POST method.
status:failed OR status>=400	Requests that failed to connect to the remote server, or that have a status code greater than 400.
method:POST AND status:500	Requests made with the GET method and that have a status code equal to 500.
(method:POST AND status:500) OR (method:GET AND status:404)	Requests that match at least one of the two specified expressions.
(method:POST OR method:GET) AND !status:200	Requests made with either the GET or the POST method, and that don't have a status code of 200.

---

Stream Views

Stream Views allow you to create custom views of requests within a bucket. Stream Views use the Live Search syntax to define their criteria and update live as new requests are made. Stream Views are defined per-bucket and can be viewed, created and modified by all members of your team.

• Creating a Stream View
• Modifying an Existing Stream View

---

Creating a Stream View

Start by entering the criteria for the view you want to create into the search box. Refer to the Live Search docs for the query syntax reference and examples. From the search results page, click Create Stream View to bring up the options popup.

For each view you can assign a name and icon to represent the view. The name will default to the search query if not specified. Once you've configured the view, click Create View.

After you've created a Stream View, it will be available in the left navigation sidebar of the Traffic Inspector for all members of your team.

---

Modifying an Existing Stream View

Select a Stream View from the left sidebar and then select Edit Stream View to update the name and icon for the view, or to delete it from your bucket.