The NetWitness Core database index has a built-in debugging feature called
inspect that provides detailed information about the composition of its indexes. The index inspect feature is located at
/index/inspect in every Core service configuration tree. Services that do not actually have an index, like Broker, do not have the
Type: String This parameter may be set to the value
all-slices to collect inspect information about every slice in the index. If it is not set, information on the current, most recently created slice is returned.
Collecting information on all slices may take a very long time to complete if there are many index slices.
Inspect returns many rows of key value pairs that represent the state of the index.
The first row returned for every slice is a summary with the following values.
|The first session ID indexed in the slice|
|The last session ID indexed in the slice|
|The first meta ID in the first session indexed in the slice|
|The last meta ID in the last session indexed in the slice|
There will be per-index summary rows returned for each index. Only value-level indexes are reported.
|The meta key name for the index|
|The path on disk to this index|
|The number of unique values stored in this index|
|The number of summary entries occupied by this index in the summary.db file|
|The number of page entries occupied by this index in the page.db file|
|The number of sessions that had a value that was inserted into this index|
|The cumulative "size" meta values for all sessions that inserted a value into this index|
|The cumulative count of packets for all sessions that inserted a value into this index|
|The first summary ID used by this index|
|The last summary ID used by this index|
|The first session ID referenced by this index|
|The last session ID referenced by this index|
Slice Summary Footer
The last row in each inspect report contains cumulative statistics for all the indexes in the slice.
|The number of indexed meta types|
|The number of unique values tracked by all indices in this slice|
|An approximate total of the memory needed to open this index slice|