AnsweredAssumed Answered

Is lookup and add really slow?

Question asked by Sean Koniarz on Jan 22, 2014
Latest reply on Jan 27, 2014 by RSA Admin

Not really sure if I am just impatient or something but it seems that lookup_and_add is really slow when you add it to a report.  I understand that it will be running additional queries against the data but it just seems to be taking too long.

 

An example is looking up windows failed logins for the past hour, our report picks up 47 unique users.  I want to lookup and add both the event computer and source IP.

 

When I run the report with no lookup_and_add I get the report back in 3.95 seconds.  When I do add the lookup_and_add I get it back in 222 seconds.  Is that really how long it would take or is something misconfigured?  Some reports are taking so long that the server errors out and I get no results back.

Outcomes