7.3 Searching for Events

Searching for events in a distributed environment is similar to how you perform a search on your local server, except that you perform the search on the selected target servers and can also include your local server.

  1. Log in to the search initiator server as a user with Search Remote Targets permission.

  2. Click New Search.

  3. Click the targets link on the upper right corner of the page.

    A page is displayed that lists the target servers that you have added, including the local server. The target servers that are disabled are also displayed, but they are dimmed.

    The targets link appears only if you have added the target servers to your local server. For more information, see Section 7.2.2, Adding a Search Target Server by Using the Administrator Credentials.

  4. Select the check boxes next to the target servers on which you want to perform a search, then click OK.

  5. Specify the search criteria in the search field, then click Search.

    If you do not specify any search criteria, the search initiator server runs a default search for all events with severity 0 to 5.

    The Search Results page displays the events from the selected target servers and the local server (if it selected). The search results are filtered through the combination of the security filter and permissions of the logged-in user and the security filter and permissions of the search proxy role on the target servers. For information on the distributed search results, see Section 7.4, Managing the Distributed Search Results.