AnsweredAssumed Answered

question on indexkeys and index values again

Question asked by huan zhou on Apr 8, 2014
Latest reply on Apr 9, 2014 by huan zhou

Hi Guys,

I have few questions on the index xml file again:

1. if now i change from indexkeys to indexvalues, will it apply to the existing index files? Or only the future index files?

Need to reset index to recreate the index files? Last time i did reset, for 1 DAC raw packets, it took a few hours to finish re-indexing.

2. Is there any benchmark available for the indexkeys or indexvalues?

The day i did some testing, for filenames, indexkeys or indexvalues got the same query time.

3. Today in one customer, the customer has around 8TB data per decoder, total 4 decoders, that means around 30TB per day. Customer complaint query sloness, I did some testing, for example ip.src=xxx.xxx.xxx.xxx, for 24 hours data, it took 20-30 seconds to finish. To me it's normal, but to customer, it's slow.

 

Any comments?

 

Thank you.

Outcomes