7.4 Managing the Distributed Search Results

The Search Results page displays the events from the selected target servers and the local server, based on the search criteria you specified. Each event displays the target server information from which the event is being retrieved.

Figure 7-2 Distributed Search Results

You can expand the event results to see the details by clicking the details++ link.

For non-internal events, the get raw data link is displayed. You can view the raw data only if your role's security filter is set to View all data.

NOTE:For search results that come from the target servers, the role that is used to retrieve raw data is not the role of the logged-in user that is performing the search on the search initiator server, but the role that is assigned to the search initiator server on the target server.

You can view the status of the search in the extended status page while a search is in progress as well as when the search has finished. To access the extended status page, click the Displaying N of M events from X targets link that appears at the top of the refinement panel.

Figure 7-3 Extended Status Page

The extended status page displays the following information:

You can further refine the distributed search results and perform various actions based on your requirement. For more information, see Section 5.0, Searching.