66-39
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter66 Viewing Events
Using Event Viewer
Note View names can be up to 128 characters and contain alphanumeric characters, spaces,
hyphens (-), underscore characters (_), plus signs (+), periods, and ampersands (&). The
description can be up to 1024 characters.

Deleting Custom Views

You can delete custom views, but you cannot delete predefined views. To delete a custom view, do one
of the following:
•Select it in the view list and click the Delete (trash can) button above the list.
•Right-click it in the view list and select Delete.
You are asked to confirm your deletion.
Filtering and Querying Events
There are many options for filtering the events that appear in the event table. You can reduce the list of
events by selecting the appropriate time range, by filtering on elements in specific columns, or even by
searching on a text string.
This section contains the following topics:
•Selecting the Time Range for Events, page 66-39
•Using the Time Slider with Filtering, page 66-40
•Refreshing the Event Table, page 66-40
•Creating Column-Based Filters, page 66-41
•Filtering Based on a Specific Event’s Values, page66-43
•Filtering on a Text String, page 66-44
•Clearing Filters, page 66-44

Selecting the Time Range for Events

Use the Time Selector control in the event table toolbar, or the equivalent View > Mo de command, to
select the time range for displaying events. The event table lists only those events that occur within the
selected time range. For help in locating the Time Selector control on the toolbar, see Event Table
Toolbar, page66-14.
Tip For historical views, the time is based on server time, not the time configured on your workstation.
When you change the time range, the table reloads to show events in the selected range. For historical
views, you can refresh the events list by clicking Start or by doing the other actions described in
Refreshing the Event Table, page66-40.
The following are your options for the time range:
•To view events from the present time into the past, select one of the following time periods: last 10
minutes, last 1 hour, last 12 hours, last 1 day, or last 1 week.
•To view events from today or yesterday, select today or yesterday, as desired.