Schedule a Background Search in the Event Viewer

Schedule a recurring query in the background in the event viewer page. You can modify or cancel the scheduled search at any time. You can also modify an existing query to be a recurring search.

Note	You can schedule a background search only for historical events. You can opt to get alerts on searches that have started, completed, or have failed.

Use the following steps to create a scheduled background search:

Procedure

Step 1	In the navigation bar, choose Events & Logs > Events > Event Logging.
Step 2	Click the Historical tab to view historical events.
Step 3	In the search bar, type the search expression you want to search for. Click the Search drop-down button and choose Search in Background.
Step 4	(Optional) Rename the search.
Step 5	The Search now check box is checked by default. When checked, the search starts upon saving; if unchecked, the background query runs only as a future search.
Step 6	Check the Setup recurring schedule and configure the following settings: Search Logs for the Last: How far back you want to search through. Frequency: How frequent you want the scheduled search to occur.
Step 7	Confirm the scheduled search criteria at the bottom of the window. Click Schedule and Search Now. If you did not opt for the search to start immediately, click Schedule Search.

What to do next

Results from a scheduled background search are available for review for up to 7 days before Security Cloud Control automatically deletes them.