<p class="shortdesc">本文介绍如何保存查询结果。</p> <section class="section prereq" id="resultSave__prereq_b2z_d4s_hsb"><div class="tasklabel"><h2 class="doc-tairway">前提条件</h2></div> <ul class="ul" id="resultSave__ul_d2g_b5b_2sb"> <li class="li">您已创建安全日志审计实例。</li> <li class="li">您已添加资产，并且资产已发送日志到平台上。</li> </ul> </section> <section><div class="tasklabel"><h2 class="doc-tairway">操作步骤</h2></div><ol class="ol steps"><li class="li step stepexpand"> <span class="ph cmd">登录<a class="xref" href="https://www.ocftcloud.com/console/log-audit" target="_blank" rel="external noopener">安全日志审计SLA控制台</a>，进入<span class="keyword wintitle">实例列表</span>页面。</span> </li><li class="li step stepexpand"> <span class="ph cmd">单击目标实例<span class="ph uicontrol"> 操作</span>列的<span class="ph uicontrol">管理</span>，进入安全日志审计控制台。</span> <div class="itemgroup info"> <img class="image" id="resultSave__d80e53" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112057-1ecc508f988a.png" width="830"> </div> </li><li class="li step stepexpand"> <span class="ph cmd">在页面上边栏选择<span class="ph uicontrol">事件管理</span>，在左侧菜单栏选择<span class="ph menucascade"><span class="ph uicontrol">事件</span><abbr> > </abbr><span class="ph uicontrol">自定义查询</span></span>，进入<span class="keyword wintitle">自定义查询</span>页面，设置查询条件，单击<span class="ph uicontrol">查询</span>。</span> </li><li class="li step stepexpand"> <span class="ph cmd">在自定义查询结果页面，单击右上角的<span class="ph uicontrol">另存为</span>。</span> <div class="itemgroup info"> <img class="image" id="resultSave__image_skl_pms_hsb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112055-1e12a16899ba.png" width="830"> </div> </li><li class="li step stepexpand"> <span class="ph cmd">在弹出的对话框中选择解决方案包、上级目录名称，编辑查询名称，单击<span class="ph uicontrol">保存</span>。保存成功后，该查询结果将会添加至<span class="ph uicontrol">已保存查询</span>列表中。</span> <div class="itemgroup info"> <img class="image" id="resultSave__image_b5f_r4s_hsb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112055-15ae662d977b.png"> </div> </li><li class="li step stepexpand"> <span class="ph cmd">在自定义查询结果页面，单击右上角的<span class="ph uicontrol">在地图中查看</span>可查看事件分布统计图，即在地图上显示世界各地近期事件的分布情况，<img class="image" id="resultSave__image_evx_pps_hsb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112055-169b00e297dd.png">为目标地址，<img class="image" id="resultSave__image_d3x_rps_hsb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112055-17c238bb9556.png">为来源地址。</span> <div class="itemgroup info"> <img class="image" id="resultSave__image_a21_vps_hsb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112055-1a3427fa9582.png" width="830"> </div> <ol type="a" class="ol substeps" id="resultSave__substeps_khv_wps_hsb"> <li class="li substep substepexpand"> <span class="ph cmd"><strong class="ph b">地图定位</strong>选择<strong class="ph b">中国</strong>，可展示中国地区事件的情况。</span> <div class="itemgroup info"> <img class="image" id="resultSave__image_xpc_yps_hsb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112055-197e18619299.png" width="780"> </div> </li> <li class="li substep substepexpand"> <span class="ph cmd">•在页面左下角的事件列表中单击某条事件，在地图上显示对应的行为操作。</span> <div class="itemgroup info"> <img class="image" id="resultSave__image_v2q_1qs_hsb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112055-11d0c2bf955d.png" width="780"> </div> </li> <li class="li substep substepexpand"> <span class="ph cmd">单击<span class="ph uicontrol">详细</span>，可以查看该事件的详细内容。</span> </li> </ol> </li><li class="li step stepexpand"> <span class="ph cmd">在自定义查询结果页面，单击右上角的<span class="ph uicontrol">导出</span>，在弹出的对话框中单击<span class="ph uicontrol">常用字段</span>列表框中的字段，将其设置为<strong class="ph b">导出字段</strong>，单击<span class="ph uicontrol">导出</span>将事件字段信息导出至本地。</span> <div class="itemgroup info"> <img class="image" id="resultSave__image_afz_gqs_hsb" src="https://obs-cn-shanghai.ocftcloud.com/pacloud/20222803112055-16a5e27691e1.png"> </div> </li></ol></section>