improved query-logs language

Author: Tracey Carter

_includes/logs/query-logs.rst

@@ -1,31 +1,32 @@
-1. Navigate to :guilabel:`Log Observer`. Upon opening, Log Observer runs an initial search of all indexes you have access to and returns the first 150,000 logs. Then, the search defaults to paused. To search for more logs, follow the steps below to determine, filters, and aggregations. 
-.. note:: Control your Splunk Virtual Compute (SVC) resources by leaving search on Pause and selecting :guilabel:`150,000` rather than "Infinite" results. Pushing :guilabel:`Play` to run a streaming search uses more system resources than running a  manual search. Streaming searches can impact performance and cost. Monitor resource usage to ensure optimal performance. Switch from streaming searches back to manual searches to optimize resource usage.
+1. Navigate to :guilabel:`Log Observer`. Upon opening, Log Observer runs an initial search of all indexes you have access to and returns the first 150,000 logs. The search then defaults to Pause in order to save Splunk Virtual Compute (SVC) resources. Control your SVC resources, which impact performance and cost, by leaving your search on Pause and selecting :guilabel:`150,000` rather than :guilabel:`Infinite` results.
 
-.. image:: /_images/logs/LogObserverEnhancements.png
-         :width: 100%
-         :alt: The Open in Splunk platform icon is at the top, right-hand side of the Logs table.
+   .. image:: /_images/logs/LogObserverEnhancements.png
+            :width: 90%
+            :alt: The Log Observer UI is displayed.
+
+   Perform the remaining steps to determine filters and aggregations.
 
-2. In the content control bar, enter a time range in the time picker if you know it.
+2. In the content control bar, enter a time range in the time picker.
 
-3. Select :guilabel:`Index` next to :guilabel:`Saved Queries`, then select the indexes you want to query. If you want to search your Splunk platform (Splunk Cloud Platform or Splunk Enterprise) data, select the integration for the appropriate Splunk platform instance first, then select which index you want to query in Log Observer. 
+3. Select :guilabel:`Index` next to :guilabel:`Saved Queries`, then select the indexes you want to query. If you want to search your Splunk platform (Splunk Cloud Platform or Splunk Enterprise) data, select the integration for the appropriate Splunk platform instance first, then select which index you want to query in Log Observer.
 
-.. note:: You can only query indexes from one Splunk platform instance or Splunk Observability Cloud instance at a time. You can query Splunk platform indexes only if you have the appropriate role and permissions in the Splunk platform instance. 
+You can query indexes from only one Splunk platform instance or Splunk Observability Cloud instance at a time. You can query Splunk platform indexes only if you have the appropriate role and permissions. 
 
 4. In the content control bar next to the index picker, select :guilabel:`Add Filter`.
 
 5. Select the :guilabel:`Keyword` tab to search on a keyword or phrase. Select the :guilabel:`Fields` tab to search on a field. Then press Enter. To continue adding keywords or fields to the search, select :guilabel:`Add Filter` again.
 
-6. Next, select :guilabel:`Unlimited` or :guilabel:`150,000` results to determine the number of results you want to return on a single search. Select :guilabel:`150,000` to optimize your Splunk Virtual Compute (SVC) resources and control performance and cost.
+6. Next, select :guilabel:`Unlimited` or :guilabel:`150,000` to determine the number of results you want to return on a single search. Select :guilabel:`150,000` to optimize your Splunk Virtual Compute (SVC) resources and control performance and cost.
 
-7. To narrow your search, use the :guilabel:`Group by` drop-down list to select the field or fields by which you want to group your results, then select :guilabel:`Apply`. To learn more about aggregation, see :ref:`logs-aggregations`.
+7. To narrow your search, use the :guilabel:`Group by` drop-down list to select the field or fields by which you want to group your results, then select :guilabel:`Apply`. To learn more about aggregations, see :ref:`logs-aggregations`.
 
 8. Select :guilabel:`Run search`.
 
 9. Review the top values for your query on the the :guilabel:`Fields` panel on right. This list includes the count of each value in the log records. To include log records with a particular value, select the field name, then select ``=``. To exclude log records with a particular value from your results, select the field name, then select ``!=``. To see the full list of values and distribution for this field, select :guilabel:`Explore all values`.
 
-10. Optionally, if you are viewing Splunk platform (Splunk Cloud Platform or Splunk Enterprise) data, you can open your query results in the Splunk platform to use SPL to further filter or work with the query results. You must have an account in Splunk platform. To open the log results in the Splunk platform, select the :guilabel:`Open in Splunk platform` icon at the top of the Logs table. 
+10. Optionally, if you are viewing Splunk platform data, you can open your query results in the Splunk platform and use SPL to further query the resulting logs. You must have an account in Splunk platform. To open the log results in the Splunk platform, select the :guilabel:`Open in Splunk platform` icon at the top of the Logs table. 
 
    .. image:: /_images/logs/lo-openinsplunk.png
-         :width: 100%
+         :width: 90%
          :alt: The Open in Splunk platform icon is at the top, right-hand side of the Logs table.
 

logs/keyword.rst

@@ -7,14 +7,11 @@ Search logs by keywords or fields
 .. meta::
   :description: Search and filter logs by keyword, field, or field values.
 
-.. include:: /_includes/log-observer-transition.rst
 
-You can search Splunk Observability Cloud logs if your Splunk Observability Cloud instance ingests logs. If your organization has integrated its Splunk platform (Splunk Cloud Platform or Splunk Enterprise) instance with its Splunk Observability Cloud instance, you can search Splunk platform logs that your Splunk platform role has permissions to see in Splunk platform. If you cannot access a log in your Splunk platform instance, you cannot access it in Splunk Observability Cloud. 
+In Log Observer Connect, you can search Splunk platform logs that your Splunk platform role has permissions to see. If you cannot access a log in your Splunk platform instance, you cannot access it in Splunk Observability Cloud. If your Splunk Observability Cloud instance ingests logs, you can search Splunk Observability Cloud logs.
 
-You can search logs that you have permissions to see for particular keywords, field names, or field values. 
-
-To search your logs, follow these steps:
+You can search for keywords, field names, or field values. To search your logs, follow these steps:
 
 .. include:: /_includes/logs/query-logs.rst
 
-When you add keywords, field names, or field values to the filters, Log Observer narrows the results in the Timeline and the Logs table so that only records containing the selected fields and values appear. To learn how you can use a productive search in the future, see :ref:`logs-save-share`.
+When you add keywords, field names, or field values to the filters, Log Observer narrows the results in the Timeline and the Logs table so that only records containing the selected fields and values appear. To learn how you can reuse a productive search in the future, see :ref:`logs-save-share`.