Save a Search

Whether you are running ad hoc searches during a forensic investigation or running standard searches for health checks, you can save any search to run again later.

When you create a search that you would like to reuse, you can save it to the Library. From there you can run it again, share with others, edit the search, or create a Scheduled Search to run at a regularly scheduled time, and set up alerts. 

The saved search will also include any charts you have created in the Aggregates tab. 

To save a search:

1. Run a search you'd like to save.
2. (Optional) After the search results are complete, in the Aggregates tab, select a chart type to display the data visually. 
3. Click the save icon on the top right of the search page,

   

   or click the three-dot icon and select Save As.

   

   The Save option is for searches that have already been saved to your Library. Save allows you to quickly update the existing saved search. The Save as option is for a new saved search and requires you to provide it a name. A saved search will provide a shortcut for both options:

   

4. In the Save Item dialog appears.

   

5. Name. Enter a name for your saved search.
6. Description. (Optional). Enter a description for the search. 
7. Query. You can edit your query if desired.
8. Choose a Time Range that will be the default range when you run the saved search.
9. Search By. Select if you want to save the search using message or receipt time. For more information, see Use Receipt Time.
10. Search Mode. Select Manual or Auto Parse Mode. For more information, see Dynamic Parsing.
11. Location to save to. Select a folder location for the saved search 
12. Click Save to save the search without scheduling.  If you want to schedule the search and optionally configure an alert, click Schedule this search and follow the instructions on Schedule a Search.