Searching for events in a distributed environment is similar to how you perform a search on your local server, except that you perform the search on the selected data source servers and can also include your local server.
Log in to the authorized requestor server as a user with Search Remote Data Sources permission.
Click New Search.
Click the Data sources link under the Search field.
A dialog box is displayed that lists the data source servers that you have added, including the local server. The data source servers that are disabled are also displayed, but they are dimmed.
Select the check boxes next to the data source servers on which you want to perform a search, then click OK.
Specify the search criteria in the search field, then click Search.
If you do not specify any search criteria, the authorized requestor server runs a default search for all events with severity 0 to 5.
The Search Results page displays the events from the selected data source servers and the local server (if selected). The search results are filtered through the combination of the security filter and permissions of the logged-in user and the security filter and permissions of the search proxy role on the data source servers. For information on the distributed search results, see Managing the Data Federation Search Results.