question on indexkeys and index values again

[huanzhou1]

Hi Guys,

I have few questions on the index xml file again:

1. if now i change from indexkeys to indexvalues, will it apply to the existing index files? Or only the future index files?

Need to reset index to recreate the index files? Last time i did reset, for 1 DAC raw packets, it took a few hours to finish re-indexing.

2. Is there any benchmark available for the indexkeys or indexvalues?

The day i did some testing, for filenames, indexkeys or indexvalues got the same query time.

3. Today in one customer, the customer has around 8TB data per decoder, total 4 decoders, that means around 30TB per day. Customer complaint query sloness, I did some testing, for example ip.src=xxx.xxx.xxx.xxx, for 24 hours data, it took 20-30 seconds to finish. To me it's normal, but to customer, it's slow.

Any comments?

Thank you.

[huanzhou1]

Thanks Scott, was thinking about this one as well.

Where to find the document on NwInvestigator.settings?

Thank you.

[huanzhou1]

how about for informer and reporting engine? is it concurrent as well? can change?

[RSAAdmin]

There isn't a document.  Investigator creates/updates that file when options are changed via Edit | Options and various other changes.  Most settings in that file are controlled thru changes within the application itself.

MaxConcurrentQueries is just an option that was never exposed in the UI.  However, by editing the file (make sure Investigator is not running), you can change the behavior of the Navigation screens.

[RSAAdmin]

I can't speak to Informer or RE as I didn't work on those products, but my guess is no.

However, it is something that is being looked at for 10.4.

[RSAAdmin]

Queries from a broker are only as fast as the slowest concentrator.  When you changed the index keys, I will hope you changed them on the concentrators too.  Next you should run your queries on the concentrators to see which one is giving you the performance issue and work to fix that one.

[huanzhou1]

Thanks a lot Scott. I will look though the settings.

Another thing i want to understand is the cache windows for broker/concentrator, do you have the details? What i understand is like sql query cache, same query will return the result immedidate if the query run with the query windows. However someone other guy said it's the data cache only, which make the query faster.

Any different between investigator with SA UI for the cache window?

Thank you.

[huanzhou1]

Hi Scott,

How about valueMax, what's the difference if set low or high value.

Thank you.