Search for Events

You can search for all events in the Events List on the Process Analysis page.

You can search for any event by typing the search text query into the Search text box and pressing Enter. The search API returns matching events.

Standard search terms apply. Be aware of the following criteria:

• Click the Later Events and Earlier Events buttons to return the respective elements. If it takes longer than the time specified in the ProcessAnalysisEventSearchTimeout parameter in the cb.conf file to return the events, the API returns a timeout and displays a timeout error message. The respective button for that search is disabled.
• If you apply a filter from the Filter panel on the left, the events that satisfy the filter and search query are returned. If you click Later Events or Earlier Events and it takes longer than the time specified in the ProcessAnalysisEventSearchTimeout parameter to return the events, the API returns a timeout, a timeout message displays, and the Later Events or Earlier Events button for which the timeout occurred is disabled. The default timeout is 30 seconds.
• In the case of a timeout, you can reset the search criteria and filter to perform a new search. You can modify or reset the query by altering or deleting the text in the Search text box and pressing Enter.

Note: Any records that were fetched until the timeout occurred are returned and displayed.

See ProcessAnalysisEventSearchTimeout in the Carbon Black EDR Server Configuration Guide.