5.1 Configure Search Preferences

Available only when ArcSight Recon is deployed in your environment.

To reduce the time required to create and manage searches, configure Search to use your preferred settings. You can always override your preferences as needed when you create a search.

Default Fieldset

Specifies the fieldset that you regularly use for a search. The default value is Base Event Fields.

Default View

Specifies whether you want the Events Table to display results in the Grid View or Raw View. The default value is Grid View.

Time Zone

Instructs Search to adjust the timestamp for events to the chosen time zone.

  • Browser

  • Database

  • Custom

To specify the type of timestamp that you want to use, modify the preference for Base Searches On.

Date / Time Format

Specifies the format of dates and times that you want Search to use. The default is YYYY/MM/DD.

For example, you might want to use the same format that you have already configured for your browser. Alternatively, you might prefer a format like MM/DD/YYYY HH:MM:SS.

Default Time Setting

Specifies the time range within which you want Search to find events. The default is Last 30 minutes.

  • Dynamic

    If you prefer to use a dynamic time range, you must also specify the Start and End times. For example, specify $Now - 30m and $Now respectively.

  • Static

    If you use different time settings for each search that you create, you might want to select this option for your preference. The default is the preset value of Last 30 minutes.

  • Preset

    If you prefer to use a preset time range, you must also specify a preset value. For example, Last 24 hours.

Base Searches On

Specifies the timestamp associated with the events that you want to find:

  • Normalized Event Time

  • Device Receipt Time

  • Database Receipt Time

Search Expires In

Specifies how often you want searches to expire, and thus be removed from the system. You can also choose to never remove a search.

Maximum Search Results

Specifies the maximum number events that the Search will return. You can specify a value between 1 and 10 million. The default is 300,000.

Highlight Query Syntax

Specifies whether you want Search to use color to differentiate the syntax terms from the operators and functions within the query.

For example, in the figure below, Search displays the variable Source Address in blue, the value 11.0.* in red, and the operator in subnet in white.

Figure 5-1 Example of Highlighted Query Syntax