Profile prequery performance problems

[DionStempfley]

Is it normal to see a performance difference when using a prequery in a custom profile vs. making the query in directly investigation?  I created a custom profile and when I added a prequery it took significantly longer to load. 

I am looking for login sessions from our different VPN solutions and added the following prequery: (device.type = 'ciscoasa' && event.desc = 'anyconnect parent session started') || (device.type = 'firepass' && alert.id = 'account:logon-success')  || ( device.type = 'aventail' && alert.id = 'account:logon-success' ). 

Any thoughts?

/Dion

[JohnSnider]

First, what version are you running?  Reason I ask is that on one of the older versions, in the profile pre-query if you did not surround the entire query in parentheses ( ) it would cause spurious results and took longer to run.  So first try adding those around the pre-query.

Secondly, instead of doing that complex pre-query, place that query as an App rule on the Log Decoder and name the rule "VPN_Logins" or something like that, them set a alert for the rule to create that meta data in something like "risk.info", or if you have custom keys created already created for your own company informational rules like "<companyname.info>" then alert to that key (meaning that where the name of the rule will be written.)

Then you pre-query can be a simple (risk.info = 'VPN_Logins') which will run faster anyway.

[DionStempfley]

Thanks for your input. We are using 10.6.2. I put the whole query in parentheses and it made a huge difference. I will also consider the app rule as well.