Configure Your User Preferences

Select [your_ID] > My Profile > PREFERENCES.

Some deployed capabilities enable you to configure preferences for commonly used settings. For example, if you regularly use the same fieldset for a Search, you can specify that set as your preferred default.

Configure Search Preferences

To reduce the time required to create and manage searches, configure Search to use your preferred settings. You can always override your preferences as needed when you create a search.

Default Fieldset
Specifies the fieldset that you regularly use for a search. The default value is Base Event Fields.
Default View
Specifies whether you want the Events Table to display results in the Grid View or Raw View. The default value is Grid View.
Time Zone

Instructs Search to adjust the timestamp for events to the chosen time zone:

  • Browser

  • Database

  • Custom

To specify the type of timestamp that you want to use, modify the preference for Base Searches On.

Date / Time Format

Specifies the format of dates and times that you want Search to use. The default is YYYY/MM/DD.

For example, you might want to use the same format that you have already configured for your browser. Alternatively, you might prefer a format like MM/DD/YYYY HH:MM:SS.

Default Time Setting

Specifies the time range within which you want Search to find events. The default is Last 30 minutes.

  • Dynamic

    If you prefer to use a dynamic time range, you must also specify the Start and End times. For example, specify $Now - 30m and $Now respectively.

  • Static

    If you use different time settings for each search that you create, you might want to select this option for your preference. The default is the preset value of Last 30 minutes.

  • Preset

    If you prefer to use a preset time range, you must also specify a preset value. For example, Last 24 hours.

Base Searches On

Specifies the timestamp associated with the events that you want to find:

  • Normalized Event Time

  • Device Receipt Time

  • Database Receipt Time

Default is Normalized Event Time.

Search Expires in

Specifies how often you want saved searches to expire, and thus for the system to remove them from the system. You can specify a value between 1 and 365. Your System Admin might also specify a different range. To specify a value above 365, check with your System Admin. The expiration date resets whenever you access the search. Resetting the expiration date includes resuming or re-running the search, as well as saving the search and changing its settings.

The default value is 7 days. Alternatively, if you have the Never Expire Search Results permission, you can choose for a search to never expire. When you create or edit a search, you can override this default setting.

Session Search Expires In

Specifies how often you want searches to expire, and thus be removed from the system. You can specify a value between 1 and 120. Your System Admin may also specify a different range. to specify a value above 120, check with your System Admin. You can also choose to never remove a search. The expiration time resets whenever you change or run the search.

When you create or edit a search, you can override this default setting.

Maximum Results for a Search

Specifies the maximum number of events that the Search will return. You can specify a value between 1000 and 10 million. The default is 300,000. When creating a search, you can override this preference.

Your admin can configure a system-level setting that controls the maximum number of searches (with a limit of 10 million) for all instances of Fusion. If you enter a value outside of the system-level setting, you will receive an error message indicating that your preferred default cannot exceed the system setting. For information about setting a global search limit in a non-SaaS environment, see Configuring the Deployed Capabilities in the Administrator's Guide for the ArcSight Platform. If you are a SaaS customer, reach out to Support to increase the search limit.

Highlight Query Syntax

Specifies whether you want Search to use color to differentiate the syntax terms from the operators and functions within the query. For example, in the figure below, Search displays the variable Source Address in blue, the value 11.0.* in red, and the operator in subnet in white.