Article Number
000002844
Applies To
RSA Security Analytics
RSA NetWitness NextGen
Issue
Difference between IndexValues and IndexKeys in RSA Security Analytics and RSA NetWitness NextGen.
What is the difference between IndexValues and IndexKeys when working with meta?
Resolution
The main difference between IndexValues and IndexKeys is as follows:
- With IndexValues we create separate index pages for each value of the key for tracking the sessions of each value
- where with an IndexKeys, we create a single page in the index for the key and merely track the sessions in which the key has meta (not the specific values).
Hence there is space saving in the index and some increased performance for initial drills if you set a key to IndexKeys over using IndexValues.
Where you will see the most difference is in Investigator where the keys with IndexKeys will always come up in a closed state regardless if there are values or not.