The "Report Performance Primer" for version 4.1 says "for historical data you MUST prioritize and re-index event data to achieve performance improvements", using the lsmaint -rebuild command.
What's a convenient way to run lsmaint across a lot of data and devices? As a command line utility, do I have to sit with an RDP window open all day while the tool runs? Can I put it in a batch job and schedule it to run off hours?
I have to imagine running this against our firewall and Windows logs is going to take a long time, even if cut up into single day or week long chunks. I've run a few lightly-trafficed devicetypes by hand, but there doesn't seem to be a way to predict how long the process will take.