Schedule a Background Search in the Event Viewer
Schedule a recurring query in the background in the event viewer page. Searches can only be scheduled for historical events. You can modify or cancel the scheduled search at any time. You can also modify an existing query to be a recurring search.
Note | You can opt to get alerts on searches that have started, completed, or have failed. |
You can schedule a background search only for historical events. Use the following steps to create a scheduled background search:
Procedure
Step 1 | In the navigation bar, choose . |
Step 2 | Click the Historical toggle to select it. You can only schedule a background search for historical events. |
Step 3 | In the search bar, type the search expression you want to search for. Click the Search drop-down button and choose Search in background. |
Step 4 | (Optional) Rename the search. |
Step 5 | The Search Now checkbox is checked by default. When checked, the search starts upon saving; if unchecked, the background query runs only as a future search. |
Step 6 | Check the Setup recurring schedule and configure the following settings:
|
Step 7 | Confirm the scheduled search criteria at the bottom of the window. Select Schedule and Search Now. Alternatively, if you did not opt for the search to start immediately, the button reads Schedule Search |
What to do next
Results from a scheduled background search are available for review for up to 7 days before CDO automatically deletes them.