We have few searches. How to find whether search is a rare search, or Dense or Sparse search.
Was there anywhere log for this thing. Please help me.
Taken from Slide 26 of the Search Optimization in 500 Easy Steps presentation given at .conf2014 by Julian Harty.
How can I determine if my search is Dense or Sparse?
Use Job Inspector…
scanCount = The number of events that are scanned or read off disk.
eventCount = Number of events that are returned to base search
• For dense searches scanCount ~= eventCount.
• For sparse searches, scanCount >> eventCount.