I have few questions on the index xml file again:
1. if now i change from indexkeys to indexvalues, will it apply to the existing index files? Or only the future index files?
Need to reset index to recreate the index files? Last time i did reset, for 1 DAC raw packets, it took a few hours to finish re-indexing.
2. Is there any benchmark available for the indexkeys or indexvalues?
The day i did some testing, for filenames, indexkeys or indexvalues got the same query time.
3. Today in one customer, the customer has around 8TB data per decoder, total 4 decoders, that means around 30TB per day. Customer complaint query sloness, I did some testing, for example ip.src=xxx.xxx.xxx.xxx, for 24 hours data, it took 20-30 seconds to finish. To me it's normal, but to customer, it's slow.