---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Define, save, and share a search of log data

# Define, save, and share a search of log data {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Define, save, and share searches of log data to help determine the causes of Log Analytics alerts.

## Before you begin

Role required: evt_mgmt_operator or evt_mgmt_admin  
Important:  
From the Vancouver release onward, the Operator Workspace is deprecated and replaced with Service Operations Workspace. For the new procedure, see the corresponding topic in the Service Operations Workspace for ITOM documentation: [Define, save, and share a search of log data](https://servicenow-prod.fluidtopics.net/6PlOdhIJn7_Ush8nKwKVkQ "Define, save, and share searches of log data to help determine the causes of Log Analytics alerts.").