Persisting Search Results

When persisting search results, users can save data and view the results at a later time, allowing you to save time and perform other activities meanwhile.

To persist searches, make sure to be granted the following minimum rights:

Logger Search Rights for search events.
Logger Search Rights for search events on remote peers.
Search Results for use and view search result.
Search Results for save search result.

The save active search function will be enabled once a query has been inserted and the preliminary results are displayed on the page. To save a search result, go to Analyze > Search, enter a query and save it. Each search result must have a unique name. For more details on how to save your search result, see Save a Filter, Saved Search, Dashboard Panel, or Search Results.

Search results are not included in the Logger configuration backup.

Caution: Make sure the retention period added for the search result is lower than the retention of the storage groups involved in the search.

Loading a Search Result

To access the search result, click the icon. Logger will not execute the search again, but rather load the results, decreasing the waiting time significantly. Depending on the query details you added, a chart or histogram will retrieve the original search result details ( field summary, discover fields, time range, query, hit events, scanned events, local only, and time type).

The search result limit is determined by the parameters described below. These are not individual values but rather shared among all users of the Logger.

Maximum limit size on disk (default value is 1GB).
Maximum limit quantity of search results (default value is 1000).

When loading data, take into consideration the following details:

Retention period hasn't expired, as the search result references will be removed from the system after expiration.
The original search is already completed and not longer active.
The search result is not being retrieved in multiple tabs of Logger.

Caution: The peer stats, fieldset, and chart type values are not persisted by Logger. Therefore, these values will not be retrieved when loading the results.

For more information on how to load a search result, see Searching with Saved Queries.