# New Relic: Search Logs

Runs an NRQL query against New Relic's Log data type over a chosen time range and returns the matching log entries found.


> **Availability:** See the [Incident Workflow Actions Overview table](/workflow-actions) for the plans this workflow is available on.

## Description

Search for logs in New Relic using NRQL (New Relic Query Language). The action runs a query against the Log data type with your chosen time range and returns matching log entries for use in your Incident Workflow.

## Instructions

1. If you have not done so, follow the instructions to [Create an Incident Workflow](/ai-automation/automation/incident-workflows#create-an-incident-workflow).
2. When the instructions prompt you to [add actions](/ai-automation/automation/incident-workflows#add-actions), select **this action**.
3. Enter the following **Inputs** and click **Save**.
4. Continue following instructions to **Publish** the Workflow.
5. When the action runs, you will see the **Outputs** listed below.

## Inputs

> **Field References:** Fields with the **\{+\}** icon accept [Field References](/ai-automation/automation/incident-workflows#field-references), which can be useful for referencing incident data or outputs created in prior workflow steps. To add Field References, click **\{+\}**, or enter `{{`, and select relevant fields. Refer to the [Field References](/ai-automation/automation/incident-workflows#field-references) article for more information.

| Name | Description |
| :--- | :--- |
| Integration | Select a [Workflow Integration](/ai-automation/automation/incident-workflows/workflow-integrations) or click **New New Relic Connection** to create one. |
| NRQL Query | The NRQL SELECT clause for the logs you want (e.g. `SELECT * `or `SELECT message, newrelic.source`). The action automatically adds `FROM Log` and your configured time range. Default: `SELECT *`. |
| Start Time | The start of the search window. Options: Past 1 Minute, 5m, 10m, 15m, 30m, 1h, 4h, 1d, 2d, 7d, 14d, 30d. Default: **1h (Past 1 Hour)**. |
| End Time | The end of the search window. Options: Now or the same past intervals as Start Time. Default: **Now**. |
| Limit | Maximum number of log entries to return. Min: 1, max: 1000. Default: **100**. |

## Outputs

| Name             | Description                                                                            |
| :--------------- | :------------------------------------------------------------------------------------- |
| Logs             | JSON array of log entries returned from New Relic.                                     |
| Log Count        | Total number of matching logs returned.                                                |
| NRQL Query Used  | The full NRQL query sent to New Relic (including `FROM Log`, time range, and `LIMIT`). |
| Time Range Start | Start time used for the search (Unix timestamp in milliseconds).                       |
| Time Range End   | End time used for the search (Unix timestamp in milliseconds).                         |
| Result           | Whether the action succeeded: **Success** or **Failed**.                               |
| Result Summary   | Short description of what the action did or why it failed.                             |
| Error            | Error message, if the action failed.                                                   |