You interact with the search components as described below.
Search
Specify a time range for the search.
Enter a search query.
Run a search.
Monitor status for the current search.
Review and interact with search results.
Save a search.
As soon as you run a search, it is added to Search Activity. When you start to type in the Search bar, the five most recent searches from Search Activity are displayed. See the Search Activity description below to know what to expect if you select one of them.
Search Activity
Monitor status for recent searches.
View details of the search.
Rerun a recent search.
Reuse search queries for efficiency and collaboration.
Up to 1000 of the most recent searches are included in Search Activity. You can see your search activity or search activity for all users. Search results are stored for 7 days. If you rerun a search within 7 days, the initial results are returned. Otherwise, you are prompted to run a fresh search. You can run the initial search or modify and then run the updated search.
Saved Searches
View list of saved searches.
Reuse saved search queries for efficiency and collaboration.
You can see your saved searches or saved searches for all users. A more experienced analyst can create queries and save them so other analysts can run them. To save time, you can save a search that is complex or that you plan to use frequently. You can run a saved search as is, or modify and then run the updated search. You can save the updated search with the same name, which overwrites the initial search, or save it as a new search.