• Introduction
  • Get Started
  • Manage Security Devices
  • Configure Devices And Services
  • Migrate Devices
  • Establish Secure Connections
  • Manage Device Configuration
  • Monitor and Analyze
    • Events in Security Cloud Control
    • Secure Event Connectors
    • Secure Logging Analytics (SaaS) for ASA Devices
    • Secure Logging Analytics (SaaS) for FDM-Managed Devices
    • Security Analytics and Logging (SaaS) for Cloud-Delivered Firewall Management Center-Managed Devices
    • View Events in Security Cloud Control
      • Viewing Live Events
      • View Historical Events
      • Customize the Events View
      • Show and Hide Columns on the Event Logging Page
      • Change the Time Zone for the Event Timestamps
      • Customizable Event Filters
      • Searching for and Filtering Events in the Event Logging Page
        • Filter Live or Historical Events
        • Filter Only NetFlow Events
        • Filter for ASA or FDM-Managed Device Syslog Events but not ASA NetFlow Events
        • Combine Filter Elements
        • Search Historical Events in the Background
          • Search for Events in the Events Logging Page
          • Schedule a Background Search in the Event Viewer
          • Download a Background Search
      • Event Attributes in Security Analytics and Logging
    • Use Cisco Secure Cloud Analytics Portal
    • FTD Dashboard
    • Monitoring and Reporting Change Logs, Workflows, and Jobs
  • Optimize Network Security and Efficiency with AI
  • Troubleshoot
  • Appendix

Schedule a Background Search in the Event Viewer

Schedule a recurring query in the background in the event viewer page. You can modify or cancel the scheduled search at any time. You can also modify an existing query to be a recurring search.

Note
  • You can schedule a background search only for historical events.

  • You can opt to get alerts on searches that have started, completed, or have failed.

Use the following steps to create a scheduled background search:

Procedure


Step 1

In the navigation bar, choose Events & Logs > Events > Event Logging.

Step 2

Click the Historical tab to view historical events.

Step 3

In the search bar, type the search expression you want to search for. Click the Search drop-down button and choose Search in Background.

Step 4

(Optional) Rename the search.

Step 5

The Search now check box is checked by default. When checked, the search starts upon saving; if unchecked, the background query runs only as a future search.

Step 6

Check the Setup recurring schedule and configure the following settings:

  • Search Logs for the Last: How far back you want to search through.

  • Frequency: How frequent you want the scheduled search to occur.

Step 7

Confirm the scheduled search criteria at the bottom of the window. Click Schedule and Search Now. If you did not opt for the search to start immediately, click Schedule Search.


What to do next

Results from a scheduled background search are available for review for up to 7 days before Security Cloud Control automatically deletes them.

Copyright © 2025, Cisco Systems, Inc. All rights reserved.