Documentation forSecurity Event Manager

Set the live and historical event limits

You can set the maximum number of events that populate the filters in your SEM Live Events and Historical Events viewers. This setting also applies to the dashboard widget showing event data.

The default setting for each is 10,000 events.

On average, every 1,000 returned search results consumes approximately 100MB of RAM, which can increase up to 10GB for one search query if the threshold is set to the 100,000 maximum. Predictably, executing multiple search queries simultaneously will add additional strain to system resources and cause diminished performance.

To change the number of events that populate these filters:

  1. On the SEM Console, click the Settings button.

  1. On the Settings page, click the Events Limits tab.

  2. Click Live or Historic, depending on which set of events you want to set the limits for, and enter the number of search results..

    You can enter between 100 and 10000000 (ten million). The default value is 100.

  3. Click Save.
  4. Restart the manager service for the new setting(s) to take place.