If you find that you must repeatedly perform a particular search, you can save it for future use from the Search tab. You can also use saved searches to monitor data trends with the help of views and set notifications that are triggered depending on the threshold set.
You can view, manage, and search for saved searches by using the Cabinet > Saved Searches tab.
This topic contains the following information:
You can save a search (query) to run again in the future.
Time Context: The time context of the search that you performed is automatically displayed. To save the search with the same time context, you can leave this selection unchanged or you can change the time context and save the search with the new time context. You might want to change the time context to monitor your search results more closely.
For example, if you are troubleshooting for an authentication failure error by performing a certain search every week (Last 7 days), then you might want to run this search every 24 hours to monitor the error more closely. For this you need to save the search with a different time context (Last 24 hours).
Note
Saved searches with custom time context cannot be added to views because such saved searches provide absolute results.
If you want the search query to be visible to all users irrespective of their access permissions, select the Make Public check box.
Note
By selecting the Make Public check box, you enable users to view the search query and run it irrespective of their access permissions, but they cannot access the data in the search results unless they have the appropriate permissions.
You can share a saved search with all users irrespective of their user roles. When you share a saved search, users can both view and run the search query. However, they can view the search results only if they have the appropriate permissions.
Select the Make Public check box.
Views and notifications are based on saved searches. So you need to be careful while changing the search query, if there are views (or notifications) associated with that search query. Views use the saved search context, therefore any change to the time context can affect views associated with the saved search.
Note
You cannot modify a saved search:
You can delete the saved search that you created. When you delete a saved search, the views and notifications associated with the saved search are also deleted.
Note
You cannot delete a saved search shared by others.
You can make a copy of a saved search, modify details if needed, and save it.
Note
If you want to add a view or a notification using a saved search marked as public, then you must first clone it.
You can add a saved search to the view for a graphic representation of the search results data.
Select the saved search that you want to add to the view, and click Add to View
.Note
You cannot add a saved search to a view in the following scenarios:
by
parameter. Creating a viewlet for such a query does not provide meaningful representation of data.* | stats count(HOST)
However, you can use a saved search shared by another user for creating a view after cloning the saved search.
Chart Type: Select one of the following chart types to summarize your search results:
Note
The pie and doughnut charts are not supported for saved searches that return tabular output. For example, timechart command.
You can also create views from the Views tab. For more information, see Managing views.
Select the saved search for which you want to add a notification, and click Create Notification
.For more information, see Adding a notification.
Note
You cannot create a notification for a saved search in the following scenarios:
However, you can use a saved search shared by another user for creating a view after cloning the saved search.
View summarization charts added to the view and detect data trends, correlations, or irregularities. For more information, see Managing views.
Create notifications to monitor irregularities and raise alerts or log events. For more information, see Managing notifications.