Novell SENTINEL LOG MANAGER 1.0.0.5 - 03-31-2010, Руководство администратора

Страница: 80 / 168

80 Sentinel Log Manager 1.0.0.4 Administration Guide
no
vd
ocx
(e
n)
19
Fe
bru
a
ry
20
10
4b To deselect all the selected event fields, click the Clear all link.
4c To undo any changes, and click Cancel .
5 The selected event fields are displayed in the REFINE pane.
A count at the right side of each event field displays the number of unique values that exist for
that field in the data directory. The calculation is based on the first 50,000 events found.
In the following two scenarios the number of events returned from a refinement will be greater
than the number of values listed for an event field:
1. The refinement performs a new search with the additional terms intersected with the initial
search string (using an AND operator). The new search will be run against all the events in
the system, including the result set from the initial search. If new events came into the
system that matches the refined search, they will be shown in the resultant set and the
event count would be greater than the field value count.