Environment

ArcSight Logger

Situation

Events are not copied back to local storage when event archives are loaded. Instead, a pointer to the archive is activated and it is included in queries.

When loading event archives that have been archived offline but still have not been affected by the system's retention policy, Logger searches against the loaded archive instead of the same data that is local to Logger resulting in a much slower search. 

Note: Even though an archive has been created, you cannot load an archive for data that is still in current storage. Loading the archive will fail if that data has not already passed it's retention date and been aged out of current storage.

 Find resolution on support portal