Snapshots lets you save events into a local file and then load and work this file like you work with event logs.
Taking snapshots is similar to making backups, but provides extra features:
You can snap visible or specific (bookmarked) events;
You don't need to have special permissions to snap;
The snapshot contains rendered event descriptions, categories and user names;
The snapshot can optionally contain extra event details like a timezone and custom columns.
To take snapshot of the event view, select Forensics->Take snapshot from the main menu.
Event scope - select whether you want to save all visible events or only bookmarked events.
Include custom columns definition - if your event log view has custom columns, their definitions will be saved in the snapshot. When loading, Event Log Explorer will create custom columns and calculate them.
Save timezone - if checked, current timezone will be saved in the snapshot. In the other case, the snapshot will be saved without the timezone. When loading, Event Log Explorer will use the default timezone.
Open snapshot after saving - Event Log Explorer will load the snapshot after saving into a new log view.
To load snapshot, select Forensics->Load snapshot from the main menu. Select the name of the snapshot file and press Open button. Event Log Explorer will load the snapshot into a new log view.
