View the Results of a Real-time Search

As with a fixed-time search, a real-time search displays events that satisfy the query and criteria in the Search Results Table, Events Histogram, and Event Inspector. However, some aspects about pausing and manipulating the display are specific to real-time searches.

1. When you pause a real-time search, the interface freezes, but events continue to build in the background as long as there is data to satisfy the search.

   • Clicking the Pause icon temporarily suspends the search.

   • Automatically pause a real-time search by clicking to zoom in.

     Drag the cursor over histogram bars to examine an area of interest. Zooming in automatically freezes the histogram and the search table results. Other ways to automatically pause a real-time search are to click a histogram bar or to scroll in the results table.

   • Observe specific details of the histogram by clicking and to zoom in and out and click to pan across multiple bars in the histogram. The real-time search will continue to be paused while you perform these actions.

   • Move forward and backward in the histogram by clicking the Back and Forward icons. The increment of backward or forward time is based on the current zoom range.

     For example, if you are zoomed in to a range of 40 minutes, clicking the Back arrow once will move the histogram backward 40 minutes. Similarly, clicking the Forward arrow once will move the histogram forward by 40 minutes at that same zoom level. As desired, you can pan the histogram up to the earliest start time or the latest (or current time.)

2. To reset the histogram and results table to the starting point when you first paused the real-time search, click the Reset icon. Note that this does not resume the real-time search; the histogram and results table remain paused.

3. To resume the real-time search, click the Go to Now icon. This search displays the current search results in the histogram and results table.

   Another way to resume a real-time search is to click the Play icon. For more information about the search's start time behavior, see Understanding Start Time and Go to Now Behavior.

4. Click to export real-time search data to a .csv file or a .pdf file. For real-time searches, only data within the time range of the current zoom state in the histogram will be exported.

 

For information about creating and saving real-time searches, see Create a Real-time Search and Save a Real-time Search.

For information about viewing the fixed-time search results, see View the Event Inspector .