AnsweredAssumed Answered

Profile prequery performance problems

Question asked by Dion Stempfley on Jan 23, 2017
Latest reply on Jan 23, 2017 by Dion Stempfley

Is it normal to see a performance difference when using a prequery in a custom profile vs. making the query in directly investigation?  I created a custom profile and when I added a prequery it took significantly longer to load. 

 

I am looking for login sessions from our different VPN solutions and added the following prequery: (device.type = 'ciscoasa' && event.desc = 'anyconnect parent session started') || (device.type = 'firepass' && alert.id = 'account:logon-success')  || ( device.type = 'aventail' && alert.id = 'account:logon-success' ). 

 

Any thoughts?

 

/Dion

Outcomes