Sentinel provides an option to perform a search on events.You can search the local data in the flat files format in the /data directory or the stored data in compressed format at the configured networked storage location.With the necessary configuration, you can also search system events generated by Sentinel, and view the raw data for each event. By default, events are returned in a reverse chronological order. This sort order relates to how the events are stored in the file system partitions.
You can also search Sentinel servers that are distributed across different geographic locations. For more information, see Searching and Reporting Events in a Distributed Environment
in the NetIQ Sentinel 7.0.1 Administration Guide.