Appendix B: Index Inspect

The NetWitness Core database index has a built-in debugging feature called inspect that provides detailed information about the composition of its indexes. The index inspect feature is located at /index/inspect in every Core service configuration tree. Services that do not actually have an index, like Broker, do not have the /index/inspect feature.

Parameters

Options

Type: String This parameter may be set to the value all-slices to collect inspect information about every slice in the index. If it is not set, information on the current, most recently created slice is returned.

Collecting information on all slices may take a very long time to complete if there are many index slices.

Response

Inspect returns many rows of key value pairs that represent the state of the index.

Slice Summary

The first row returned for every slice is a summary with the following values.

session1 The first session ID indexed in the slice
session2 The last session ID indexed in the slice
meta1 The first meta ID in the first session indexed in the slice
meta2 The last meta ID in the last session indexed in the slice

Per-Index Summary

There will be per-index summary rows returned for each index. Only value-level indexes are reported.

key The meta key name for the index
pathname The path on disk to this index
values The number of unique values stored in this index
summaries The number of summary entries occupied by this index in the summary.db file
pages The number of page entries occupied by this index in the page.db file
sessions The number of sessions that had a value that was inserted into this index
size The cumulative "size" meta values for all sessions that inserted a value into this index
packets The cumulative count of packets for all sessions that inserted a value into this index
summary1 The first summary ID used by this index
summary2 The last summary ID used by this index
session1 The first session ID referenced by this index
session2 The last session ID referenced by this index

Slice Summary Footer

The last row in each inspect report contains cumulative statistics for all the indexes in the slice.

totalKeys The number of indexed meta types
totalValues The number of unique values tracked by all indices in this slice
totalMemory An approximate total of the memory needed to open this index slice