A follow-up to Drill-down Search: the same tabbed UI now has a second mode, Sequence Search.
What does searching by “order” mean?
Drill-down finds words that occur near each other. Sequence Search finds order: only the places where w1 → w2 → w3 appear in that sequence.
In log terms: you want only the spots where “login → timeout → restart” happened in that order. An and/or search can only say “all three words are present” — but an incident is a story, and stories have order. A different order is a different incident.
In the security world this is exactly Elastic EQL’s sequence and Splunk’s transaction — but both require the data to be ingested into a server first. Almost nothing lets you do this against a multi-gigabyte file sitting on your own machine.
Real example: 60 “Tokyo → Yokohama → Nakamachi” flows in a 100-million-line file
The screenshot above is a 100-million-line XML extract of OpenStreetMap Japan:
Tokyo (21,948) → Yokohama (874) → Nakamachi (60)
“Tokyo” appears 21,948 times. Of those, 874 are later followed by “Yokohama” — and only 60 flows continue on to “Nakamachi”. Usage is identical to Drill-down: switch the refine bar’s mode to “Sequence” and keep adding words.
If an earlier word reappears mid-match, the automaton restarts from it (Tokyo → Yokohama → another Tokyo? Matching resumes from the new Tokyo). What survives is only the clean, uninterrupted flow.
The path itself is visible — the History menu
My favorite part of this implementation is the right-click menu on any result.
Open History (refinement path) and you see the position of every word that formed that sequence — e.g. “line 711,638: Tokyo → line 713,709: Yokohama → line 713,987: Nakamachi” — and you can jump to the file at any of those lines.
No reverse-engineering “why did this line match?” in your head. You see the actual path of the matched flow, and you can walk it. Even EQL and Splunk don’t show it this directly.
Speed
Each stage of Sequence Search scans the file body starting from the previous stage’s result positions. The starting points are narrowed, but the processing itself is equivalent to a full-text search — so each stage takes roughly as long as a full-text search. This is the one way it differs from Drill-down, where stages after the first are instant (Drill-down only re-searches inside the previous stage’s ±N context blocks). As with Drill-down, the ±N context lines are set independently per stage.
Get it (V1.3 in preparation)
Drill-down and Sequence Search ship in UwView Pro V1.3 and later (V1.3 is in preparation). The free edition keeps the classic single-stage search with ±1 context and result export.
The current release, UwView Pro V1.2.2, is available on Polar. The monthly subscription comes with the first month free (the one-time purchase has no free trial).
- Buy UwView Pro V1.2.2 (Polar — one-time $129 / $9 per month, first month free): https://buy.polar.sh/polar_cl_37MuoKb8WjSfLZ7hhjaTTzwAVBxu2XyqbnuWe3aGzbj
- UwView Pro product page: https://uvp.y42u.net/en/pro-en/
- Free UwView: https://github.com/amru195704/UwView
Noticed an unfamiliar name in the screenshot’s title bar? “UwEditor Pro” is an editing-capable superset of UwView Pro, currently in development. More on that soon.
