historical search

historical search


A search that has a distinct time range, such as the past hour, the previous day, or "between 2 and 4 last Tuesday". Historical searches usually review data in the past, but you can set up these searches to review events with future-dated timestamps, if your index contains them.

This term differentiates historical searches from real-time searches, which run over a window of time until they are stopped and which search incoming events as they are processed for indexing.

For more information

In the Search Manual: