000027654 - Difference between IndexValues and IndexKeys in RSA Security Analytics and RSA NetWitness NextGen

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000027654
Applies ToRSA Security Analytics
RSA NetWitness NextGen
IssueDifference between IndexValues and IndexKeys in RSA Security Analytics and RSA NetWitness NextGen.
What is the difference between IndexValues and IndexKeys when working with meta?
ResolutionThe main difference between IndexValues and IndexKeys is as follows:
  • With IndexValues we create separate index pages for each value of the key for tracking the sessions of each value
  • where with an IndexKeys, we create a single page in the index for the key and merely track the sessions in which the key has meta (not the specific values).

Hence there is space saving in the index and some increased performance for initial drills if you set a key to IndexKeys over using IndexValues.

Where you will see the most difference is in Investigator where the keys with IndexKeys will always come up in a closed state regardless if there are values or not.
Legacy Article IDa59809

Attachments

    Outcomes