Security Compliance

Delete a scheduled saved search in SEM

This article applies to Security Event Manager (formerly Log & Event Manager) and provides steps on how to delete or disable a saved search query that is scheduled by SEM users but still keep the searching and sending email alerts.

First published date

11/5/2018 10:11 PM

Last published date

4/25/2023 10:53 AM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager). It provides steps to delete/un-schedule Saved Searches.

Product section

Security Event Manager

Cause

N/A

Resolution

Via HTML5 Web Console: 
  1. Login to SEM's HTML5 web console.
  2. Go to Historical Events
  3. Select Queries Tab > Search for the query or just type scheduled. 
  4. Move the cursor on the 3 dots right to the query 
  5. Select Un-schedule or delete.  (or)
  6. At Step 4, select "Manage saved queries" 
  7. Refine the results with "Scheduled" filter and repeat Step 5

Via LEM's Flash Console:​​​​​​​​​​​​​​
  1. Log in to the SEM Flash Console.
  2. Go to the nDepth page via  Explore > nDepth.
  3. Scroll down to the lower left to find saved searches.
  4. Select the saved search that is scheduled to send an email or make an internal event.
  5. Click the gear icon on upper right to find the Saved Searches widget.
  6. Select the Delete Schedule option.
  7. Click Yes when the Are you sure you want to delete the schedule prompt opens. 

 

The icon for the saved search has changed to a single orange circle. 

The saved search no longer has a schedule tied to it, and the search itself is still saved in the list.