Novell SENTINEL LOG MANAGER 1.0.0.5 - 03-31-2010, Administration Manual

Page: 79 / 168

Searching 79
no
vd
ocx
(e
n)
19
Fe
bru
a
ry
20
10
For performance considerations, the number of events sampled to calculate the event field value
statistics are limited. If the search result set contains less than 50,000 events, the refinement field
will be based on the entire result set. However, if the result set contains more than 50,000 events,
only the first 50,000 will be sampled. The sampling size is displayed in the field count label as
Field counts based on the first <sample-size> events
, where
<sample-size>
will be
replaced by the actual sampling size.
To refine search results:
1 Log in to Novell Sentinel Log Manager.
2 Run an event search.
For more information on how to run an event search, see
“Running an Event Search” on
page 75 .
3 Select an option from SORT BY to sort the search results.
You can sort the search results based on the time when the event occurred and when the event
was stored.
4 Click fields in the REFINE section.The Select Event Fields window is displayed.
NOTE: The events selection is on a per-user basis. Each user can have a different set of
selected events.
4a To refine the search, select the event fields from the available fields, and click Save .