Select Search > Scheduled Searches > Completed.
You must have the Scheduled Search permission to schedule searches.
After creating a scheduled search, you can view, delete, export, and filter the completed runs of that search. The results of a completed run are immutable. That is, if you edit the settings or query of a completed run, your changes do not affect the original results stored in the Completed list of scheduled searches.
Select Search > Scheduled Searches > Completed.
The name of a completed run represents the name of the scheduled search name plus its start date and time. Search groups all completed runs of the same scheduled search under that scheduled search. When a run is in progress, Search displays the number of events received thus far and when the last chunk of data was received. Also, a flag beside the name of a completed run indicates that the settings for that scheduled search were changed before this run.
In the Completed tab, you can perform the following actions:
To view completed search results, click the Eye icon beside the search name.
To change the sort order, click the column heading.
To rearrange the order of the columns, drag each column to new position.
To find a keyword, click in the field next to the Magnifying Glass icon (Search Keyword), enter a value, and the system displays your results automatically.
To hide and display a column, in the far right-corner of the window, click the Wrench icon (Manage Columns), and then select and clear the column name checkboxes.
To filter scheduled searches based on Status and Fieldset, select the corresponding filter parameter. You can also filter completed scheduled searches based on a time range (custom and preset).
To filter the data for more specific results, in the far right-corner of the window, click the Funnel icon (Filters), and then select and clear the filter options. To filter the results based on execution time, set the date picker filter in the far right corner.
Each completed run has a unique Search Results ID, which allows you to create a report based on the search results.
To copy the ID, view the search results. Then either copy the ID from the URL or select the Copy icon above the Events table. To complete the process, follow the steps in Build a Report Using Search Results.
You can delete a completed run of a scheduled search at any time.
Select Search > Scheduled Searches > Completed.
Select the completed runs that you want to delete.
Click the delete icon.
You can export the completed run of a scheduled search to CSV format.
Select Search > Scheduled Searches > Completed.
Click the CSV icon next to the name of the scheduled search that you want to export.
Alternatively, view the search, then select the CSV icon to export the results.