Using advanced search

Article
02/09/2024

Important

This version of Operations Manager has reached the end of support. We recommend you to upgrade to Operations Manager 2022.

In System Center Operations Manager, advanced search is available in My Workspace, when you create a new search. You can also open advanced search in the Monitoring workspace on the Tools menu.

Use advanced search to search for a specific object type that meets specified criteria. Advanced search has two steps:

Select the specific object type and criteria
Set the criteria values

You can also save the searches you create.

Select the specific object type and criteria

Each object type displays a unique set of criteria for your search. The following table lists the object types and the criteria available for each.

Object type	Criteria associated with the object type
Alerts	- Of a specific severity - Of a specific priority - Created by specific sources - With specific resolution state - With a specific name - With specific text in the description - Created in specific time period - Assigned to a specific owner - Raised by an instance with a specific name - Last modified by a specific user - That was modified in specific time period - Had its resolution state changed in a specific time period - That was resolved in a specific time period - Resolved by specific user - With a specific ticket ID - Was added to the database in a specific time period - For a specific site - With specific text in the available custom fields
Events	- Generated by specific rules - With a specific event number - From a specific source - Generated in specific time period - Raised by an instance with a specific name - With specific severity level - From a specific user - Logged by a specific computer
Managed Objects	- With a specific name - In specific health state - Contained in a specific group
Monitors	- With a specific name - With specific text in the description - The monitor has been overridden for any context (excluding category overrides) - With specific category - Creates an alert when specific state is detected - The monitor generates alerts of specific priority - Autoresolves alerts - The monitor is a unit monitor - The monitor is an aggregate monitor - The monitor is a dependency monitor
Object Discoveries	- With a specific name - With specific text in the description - The object discovery has been overridden for any context (excluding category overrides) - With specific category - Is enabled - The object discovery confirms delivery - The rule is remotable ¹ - Was added in a specified time period - Was modified in a specified time period
Rules	- With a specific name - With specific text in the description - The rule has been overridden for any context (excluding category overrides) - With specific category - The rule generates alerts of specific priority - Is enabled - The rule confirms delivery - The rule is remotable ¹ - Was added in a specified time period - Was modified in a specified time period
Tasks	- With a specific name - With specific text in the description - Is enabled - Was added in a specified time period - Was modified in a specified time period
Views	- With a specific name - With specific text in the description - Was added in a specified time period - Was modified in a specified time period

¹ A remotable rule or discovery can run against a computer that doesn't have an agent installed.

Set the criteria values

If you've ever created a rule in Microsoft Outlook, setting criteria values for an advanced search will be familiar to you. When you select a criterion for an object, it's added to the Criteria description section. Most criteria contain a variable value. For example, in the criterion With a specific name, specific is a variable and will be underlined in the Criteria description section. (The criterion Is enabled is only true or false, so it contains no variables; you either select it or you don't select it.)

To assign a value to the variable, select the underlined portion of the criterion. A dialog appears. In the example of With a specific name, you enter a text string for the specific name. For variables with limited values, such as alert priorities, the dialog provides checkboxes that you can select.

Running and saving searches

After you set the values for the search criteria, you can run the search by selecting Search or you can save the search by selecting Save parameters to My Favorites. Saved searches are displayed in My Workspace and can be run at any time.

When you run a search or a saved search, a window opens with a view appropriate to the object type of your search. For example, a search on object type Alerts opens an Alert View window. A hyperlinked action, Show parameters, is displayed below the view title bar. You can select Show parameters to change the search parameters.

Note

When you run a saved search, change the parameters, select Search, and then close the results window; you are asked if you want to save the changes to the search.

Examples of using advanced search in Operations Manager

The following table lists examples of using advanced search to find objects in Operations Manager:

To find	Use this object, condition, and value
All alerts closed in the previous 2 hours.	- Object: Alerts - Condition/Value: With specific resolution state/Closed - Condition/Value: That was resolved in a specific time period/Last 2 Hours
All rules that have overrides	- Object: Rules - Condition: the rule has been overridden for any context (excluding category overrides)
All monitors that autoresolve alerts	- Object: Monitors - Condition: autoresolves alerts
All Unix computers in a warning or critical state	- Object: Managed Objects - Condition/Value: In specific health state/warning, critical - Condition/Value: Contained in a specific group/Unix Computer Group

Next steps

To filter your view of monitoring data so that you can find the exact monitoring object or group of objects that you need, see Finding Data and Objects in the Operations Manager Consoles.

Share via