Schedule a Background Search in the Event Viewer

Schedule a recurring query in the background in the event viewer page. Searches can only be scheduled for historical events. You can modify or cancel the scheduled search at any time. You can also modify an existing query to be a recurring search.

Note	You can opt to get alerts on searches that have started, completed, or have failed.

You can schedule a background search only for historical events. Use the following steps to create a scheduled background search:

Procedure

Step 1	In the navigation bar, choose Analytics > Event Logging.
Step 2	Click the Historical toggle to select it. You can only schedule a background search for historical events.
Step 3	In the search bar, type the search expression you want to search for. Click the Search drop-down button and choose Search in background.
Step 4	(Optional) Rename the search.
Step 5	The Search Now checkbox is checked by default. When checked, the search starts upon saving; if unchecked, the background query runs only as a future search.
Step 6	Check the Setup recurring schedule and configure the following settings: Search Logs for the Last - How far back you want to search through. Frequency - How frequent you want the scheduled search to occur.
Step 7	Confirm the scheduled search criteria at the bottom of the window. Select Schedule and Search Now. Alternatively, if you did not opt for the search to start immediately, the button reads Schedule Search

What to do next

Results from a scheduled background search are available for review for up to 7 days before CDO automatically deletes them.