Thanks - here's the confusion (and trying to avoid drilling into our environment, examining search-logs etc,
rather to better understand startup.handoff and how to tune it if applicable (conf variables to dig into etc),
regardless of our results - what does the attribute represent and directions to tune it if relevant.
Apologies if missing the boat - allot of folks are asking about this in various ways (google is our friend 🙂
taking a very simple query, run in fast-mode ("index=iis sourcetype=iis earliest=-65m@m latest=-5m@m|stats count by cs_host")
the query took approximately 31 seconds to complete
e.g. from the job inspector
This search has completed and has returned 2,018 results by scanning 4,439,123 events in 30.905 seconds.
We have fourteen (14) indexers running, our startup.handoff for the same search=141,579,974,861.00
doing that math (assuming it is seconds as the output suggests) 141,579,974,861.00 / 14 / 86400 == 1638657 days to run ?
(if it's milliseconds take it down a few notches) -
so still confused (despite the documentation) as to what startup.handoff really represents?
... View more