We have a search head cluster with 8 search head nodes ( captain was set to ad-hoc search only), and replication factor is 2 , we use schedule search to grant user access to the data they need instead of granting user access to index. This method is working for access control , but we are facing performance issue because of the huge amount of artifact(more than 10 thousands of artifact in the cluster). The loadjob command will run 30-40s even if the saved search only has 1 event , we checked the job inspector and found the most of time was spent on loadjob command.
Drilling down to the detail log, the most of time were likely spent on finding the artifact according to the owner,app and search name and pull the artifact from the search head it's stored. Then we try to use sid instead in the loadjob command, it's really faster than using "owner:app:search name", runtime is less than 1 second.
Do you know the difference between using sid and "owner:app:search name" ？
Thanks
