Documentation forSecurity Event Manager

Create a historical event query from a live event filter

Using a live event filter, you can create a historical event query that locates historical events for a time range greater than seven days and up to thirty days. After you create and save the query, you can schedule the query to run automatically on specific times and days for your reporting purposes.

  1. Log in to SEM.

  2. In the toolbar, click Live Events.

  3. In the left column under Filters, maximize a category and select a filter.

    When you select a filter, use the following guidelines:

    • A filter that contains an asterisk ( * ) works differently in a historical search.

    • Time of day groups (such as Business Hours) are not supported in a historical search, and will be removed from your historical event query.

    • Time and date data that use a time value formatted in milliseconds will not be used since historical events only support data types that use a time value formatted in seconds.

  4. Hover over the selected filter, click the vertical ellipsis next to the filter name, and select View historical data.

  5. In the Historical Events screen toolbar, click the time selector link.

  6. Select a time range greater than seven days and up to 30 days.

  7. (Optional) Save the query.

    1. In the Historical Events toolbar, click Options and select Save query as new. If you plan to schedule the query, select Save and schedule.

    2. In the Save query as new pop-up window, enter a name for your query.

    3. Click Save.

      The query is saved to the User-created category in the Filters column.

      If you select Save and schedule in the Options menu, you can schedule the query to run automatically at set times and days. After each scheduled query, SEM can send the results to one or more email addresses or add the results to your dashboard widgets.