View a Completed Run of a Scheduled Search

You must have the Manage Scheduled Searches permission to schedule runs of a search.

Select Search > Scheduled Searches > Completed.

The name of a completed run represents the name of the scheduled search name plus its start date and time.

When a run is in progress, Search displays the number of events received thus far and when the last chunk of data was received. Also, a flag beside the name of a completed run indicates that the settings for that scheduled search were changed before this run.

A completed run can fail if the global search limit is exceeded. To verify if the global search limit was reached, create a new search. If the error message: "An error occurred while creating search. Exceeding the limit of 1000 global searches." displays, then the limit was reached. Contact your Administrator to increase the search limit or delete some existing searches. If you are a SaaS customer, reach out to Support to increase the search limit. For more information about increasing search limits, see Configuring the Deployed Capabilities in the Administrator's Guide to ArcSight Platform.

In the Completed tab, you can perform the following actions:

View all details for a completed schedule search

To view completed search results, click the Eye icon beside the search name.

Sort the data in columns

To change the sort order, click the column heading.

Reorder columns

To rearrange the order of the columns, drag each column to new position.

Search for a search keyword

To find a keyword, click in the field next to the Magnifying Glass icon (Search Keyword), enter a value, and the system displays your results automatically.

Hide and display columns

To hide and display a column, in the far right-corner of the window, click the Wrench icon (Manage Columns), and then select and clear the column name checkboxes.

Filter the data in columns

To filter scheduled searches based on Status and Fieldset, select the corresponding filter parameter. You can also filter completed scheduled searches based on a time range (custom and preset).

To filter the data for more specific results, in the far right-corner of the window, click the Funnel icon (Filters), and then select and clear the filter options. To filter the results based on execution time, set the date picker filter in the far right corner.