topic Re: Does INDEXED_EXTRACTIONS work for Active Directory in Getting Data In

Does INDEXED_EXTRACTIONS work for Active Directory

a212830 — Sat, 05 Nov 2016 22:09:06 GMT

Hi,

I'm looking at options for improving some reporting for a heavy feed from AD. Is INDEXED_EXTRACTIONS supported for AD events?

Re: Does INDEXED_EXTRACTIONS work for Active Directory

jkat54 — Sun, 06 Nov 2016 01:35:57 GMT

To my knowledge INDEXED_EXTRACTIONS only works on csv, psv, JSON, or xml data. It causes the KvP to be indexed which takes up more disk space but can provide a boost in speed at search time. If you're not indexing those types of data however, the setting won't do anything.

If you do desire to fully index the field however and you're not ingesting such structured data, you can do so with the TRANSFORM-className stanza in props.conf and a corresponding entry in transforms.conf.

Doing so however would add more "pressure" on the indexing side as it takes longer to write more data and this is probably not the solution you're looking for since you're describing the data as "heavy". If you're looking for extra bandwidth on the indexing side, let us know and we can offer some solutions. If you're experiencing slow search across this data, then we can offer other ideas.

Re: Does INDEXED_EXTRACTIONS work for Active Directory

a212830 — Sun, 06 Nov 2016 02:08:30 GMT

Thanks. The AD feed is pretty busy, and I have a customer who wants to present a dashboard that does about 9 or 10 different panels, with different counts of fields and values. Unfortunately, the dashboard takes waaay to long, so I'm looking for ways to speed it up.

Re: Does INDEXED_EXTRACTIONS work for Active Directory

jkat54 — Sun, 06 Nov 2016 14:06:41 GMT

You have many options.

Increase search speed by throwing faster / more disk at it.
Create data models to drive the dashboard
Create better / optimized searches.
Reduce the panels (I try to forced everyone to put six panels max)
Create a root dashboard search if applicable.
"Power" the dashboard with accelerated searches where applicable or scheduled reports.
"Power" the dashboard with summarized data.

Re: Does INDEXED_EXTRACTIONS work for Active Directory

sloshburch — Mon, 07 Nov 2016 16:52:45 GMT

I agree. Esp the data model (accelerated) as well as using post process searches in the dashboard.