Change the Settings of a Storage Group

After creating or modifying storage groups, you must apply the changes. You can modify multiple groups before applying your changes. To indicate that that one or more groups have pending changes, the system displays the Apply Changes to System option at the top of the Storage Groups page.

• Modify a Storage Group

• Apply Your Changes to a Storage Group

Modify a Storage Group

You can modify a storage group at any time.

1. Select Configuration > Storage.
2. Select the storage group that you want to modify.
3. Click the pencil icon.
4. For Group Status, slide the indicator left or right.
5. Activated groups will display a status of Active.
6. Click Save.

7. Apply your changes.

Apply Your Changes to a Storage Group

Select Configuration > Storage > Apply Changes to System.

When you change the query filter, status, or rank of a storage group, your changes do not go into effect until you apply the changes. The following considerations affect how your changes are applied:

• If you modify the query filter, the system will begin adding events that match the updated filter. However, the storage group retains all currently stored events associated with the previous filter. The retention policies continue to apply to all events within the group.

• If you do not want the storage group to have both sets of events, you can create a new storage group for the updated query filter, then deactivate the older storage group.

• On the first day of the month, the ArcSight Database deletes events matching the retention policies of the storage groups. For example, on March 15, you change the deletion time to three months from four months. On April 1, the database begins deleting all data older than three months.

• While changes are being applied, you cannot create or modify a storage group.