Documentation forSecurity Event Manager

Set search and filter thresholds

On the SEM Console, you can set the maximum number of results per search query, as well as the maximum number of events appearing in each Events viewer filter. Searches and filters with a high maximum threshold can negatively impact SEM performance, so consider a low-to-moderate maximum threshold.

Click the Analyze tab to establish settings for analyzing historical data, and click the Monitor tab to establish settings for the Events viewer, associated filters, and widgets.

  1. On the SEM Console, click the Settings button.

  1. On the Settings page, click the Events Limits tab.
  2. Set the max number of search results.
    1. Click the Analyze tab.
    2. Enter the max number of historical search results.
    3. Set the max number of filter results.

      The default setting is 10,000 events. This means SEM will store 10,000 events in memory for each filter in the Events viewer. This also applies to the number of events that appear in your dashboard widgets.

    4. Click the Monitor tab.
    5. Enter the base limit and the maximum number of events, and then click Save.
  3. On the confirmation message, click Save.

    For this change to take effect, restart the manager service.

  4. To return to the Event viewer, click the Events tab.