Understand Search Limits

For real-time searches, once a search reaches the search limit, the oldest events are removed as new events are added.

For fixed-time searches, if you exceed the global search limit, the system displays an error message when you create a new search: An error occurred while creating search. Exceeding the limit of 1000 searches. You cannot create more searches if this error displays.

You can either delete some existing searches or contact your Administrator to increase the search limit.

• If you are an ArcSight SaaS customer, reach out to Support to increase the search limit.

• For more information about increasing the search limit in a non-SaaS environment, see "Core Components" in the "Configuring the Deployed Capabilities" section of the guide corresponding to your deployment:

  • Administrator's Guide for the ArcSight Platform 24.2 - AWS Deployment

  • Administrator's Guide for the ArcSight Platform 24.2 - Azure Deployment

  • Administrator's Guide for the ArcSight Platform 24.2 - Google Cloud Deployment

  • Administrator's Guide for the ArcSight Platform 24.2 - Off-cloud Deployment