Hello, We started to investigate but we did not finish. The fast mode does not improve the research performances. We deactivated some operations in the props.conf file. The performances became normal when we deactivated the extracts operations. In the next steps, we planed to investigate further, by checking the internal logs, manually running the extracts operations, and check if some specific lines harm the add-on performances. Do not hesitate to answer if you have any other suggestions! ... View more

Hello, Thanks a lot for your answer. After a few test, the same bug happens when we import 1 day logs (500 Mb) in the debug environment. So that the problem seems to come from the Cisco logs themselves. We will try to activate / deactivate transformations in the props.conf file (I will start with the lookups) and I will keep the community up-to-date! Do not hesitate to suggest some other action we should take!  Thanks for your help!     ... View more