Previous Topic: Customize a Search

Next Topic: Filter the Search Results

View Search Results

When using the iConsole to review events, you can update the audit status for events and individual event issues.

To view the search results

  1. Run the search: In the iConsole, run a search.

    The search results screen lists all events matching the search criteria.

  2. Browse the results: Use the navigation buttons to browse the events.

    iconsole navigation buttons

  3. Review multiple events at the same time: If required, you can simultaneously review multiple events. For example, you may want to set the audit status for a several events to 'Approved'. You can use the one-click review buttons for bulk auditing:

    one click review buttons

    These buttons are configured in the Administration console and allow you to instantly change specific audit details from one value to another.

  4. Zero in on individual events: Click any event to view its details at the bottom of the page. First, you may be prompted to enable automatic auditing; see the next step.
  5. Enable automatic auditing? If you have the appropriate privilege, you will see the Audit Operations dialog when you first review an event. This asks whether you want to update event histories each time you view an event.
  6. View details for the current event: The search results screen shows the event details in Quick View. Details are organized into three panes:
    Content pane

    Shows the unformatted text content (if captured).

    Information pane

    Shows key event details such as its severity, plus a summary of any policy applied to the event.

    Audit pane

    Shows any issues raised against the event, plus the event's history (such as changes to its audit status).

    Hold down the keyboard Ctrl button and click the Content, Information or Audit toolbar buttons to hide or show individual panes.

  7. While viewing an individual event, you can do any of the following: