Saving search criteria

You can save configured search criteria so that you can reuse the criteria and use the saved search criteria in other components, such as reports. Saved search criteria does not expire.

About this task

If you specify a time range for your search, then your search name is appended with the specified time range. For example, a saved search named Exploits by Source with a time range of Last 5 minutes becomes Exploits by Source - Last 5 minutes.

If you change a column set in a previously saved search, and then save the search criteria using the same name, previous accumulations for time series charts are lost.

Procedure

  1. Choose one of the following options:
    • Click the Log Activity tab.
    • Click the Network Activity tab.
  2. Perform a search.
  3. Click Save Criteria.
  4. Enter values for the parameters:
    Option Description
    Parameter Description
    Search Name Type the unique name that you want to assign to this search criteria.
    Assign Search to Group(s) Select the check box for the group you want to assign this saved search. If you do not select a group, this saved search is assigned to the Other group by default. For more information, see Managing search groups.
    Manage Groups Click Manage Groups to manage search groups. For more information, see Managing search groups.
    Timespan options: Choose one of the following options:
    • Real Time (streaming) - Select this option to filter your search results while in streaming mode.
    • Last Interval (auto refresh) - Select this option to filter your search results while in auto-refresh mode. The Log Activity and Network Activity tabs refreshes at one-minute intervals to display the most recent information.
    • Recent - Select this option and, from this list box, select the time range that you want to filter for.
    • Specific Interval- Select this option and, from the calendar, select the date and time range you want to filter for.
    Include in my Quick Searches Select this check box to include this search in your Quick Search list box on the toolbar.
    Include in my Dashboard Select this check box to include the data from your saved search on the Dashboard tab. For more information about the Dashboard tab, see Dashboard management.
    Note: This parameter is only displayed if the search is grouped.
    Set as Default

    Select this check box to set this search as your default search.
    Share with Everyone Select this check box to share these search requirements with all users.
    Restriction: You must have the Admin security profile to share search requirements.
  5. Click OK.