I'm seeing three seconds of latency introduced to each search when using ~3,500 indexes. Here's the scenario:
~3,000,000 events for source "X", all stored within the main default index
No data in any of the other custom ~3,500 indexes
Free license
32g/ram, i7 series 4, 1tb/ssd
I've not violated the free tier indexing threshold
Using the admin account, a search as simple as "sourcetype=x" seems to wait roughly three seconds before beginning to fetch results. When I remove all the custom indexes, things fly like normal. Considering I'm not storing data in the extra indexes yet, I wouldn't expect a noticeable performance impact. As I create additional indexes, performance seems to drop.
What could be causing this? This link suggests it's not the number of indexes that count, it's the data. My experience shows the inverse. What is the maximum number of indexes per instance before running into issues?
... View more