Understand Session Search versus Saved Search Results

The system enables you to initiate temporary searches, as well as save searches to run again. The Home tab lists all your current searches. Therefore, if you close the search tabs or lose the search tabs by logging out, you can open them again from the Home tab. However, if the search results have expired, you cannot re-open the search.

Session Searches

As you initiate a search, your activity is automatically preserved in case you need to navigate to another search tab or to a different feature in the ArcSight Platform. Search temporarily maintains these session searches after you close the search tabs, exit your browser, or log out. The system might automatically log you out if you have not interacted with the interface for longer than an idle time specified by your system administrator.

The session search expires once the specified expiration time is reached, regardless of the level of activity in the session.

Saved Search Results

For long-term use of a search, you must save the query, criteria, or results. Note that, for a real-time search, you cannot save the query. You can review and manage your saved searches at any time:

Expired Searches

Session and saved searches usually expire after a specified amount of time. 

When a search expires, the system deletes all information about the search. If this occurs when you have the search open in a tab, you will receive a notification that the search has expired and be instructed to close the tab.

The session search expires once the specified expiration time is reached, regardless of the level of activity in the session. You may reset the expiration time by running the search again or by modifying the query or criteria. However, if the search has already expired, you cannot reset the expiration clock. You can also override the default expiration time by changing the Search expires in setting for a particular session search.

By default, search results expire after seven days. (You may modify this value in your user preferences.)

User Activity With Real-time Searches

After a certain number of minutes, the application will log you out and redirect you to a Login page if the system does not detect any user activity in an open search tab that contains a running real-time search.

To avoid the logout behavior, you can request your system administrator to activate the Never Expire Session for Real-Time Searches permission. This allows the user to leave a running real-time search opened in a tab and prevents the logout if there is no interaction with the user interface. User interface activities include scrolling, mouse movements, mouse drags, clicks, zooming in or out, and keystrokes.