cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 5

Query taking a long time to run.

I need to search through all my events for a specific event where an item is being deleted.  The time I am running the querey against is all of last month.  So basically I am doing all esm, object = folder , all last month.  But it has been running for like 3 hours and has not brought anything back.  Is there a better way I should be doing these "big" searches?

4 Replies
sssyyy
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 5

Re: Query taking a long time to run.

Try select the specific device/data source and search or use the ELM for the specific device.

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 5

Re: Query taking a long time to run.

They arent sure which device it came across thats why I had to do such a big search.

akerr
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 5

Re: Query taking a long time to run.

Searching by object is going to be a text search which is going to take a long time as it won't be indexed.

 

Instead, try to find the signature ID preferably or even the normalized ID for the events you are looking for, even if you need to generate a known event on a known device to do it.  Searching by signature will go a lot faster.

Former Member
Not applicable
Report Inappropriate Content
Message 5 of 5

Re: Query taking a long time to run.

Thank you this did actually help alot.  We also had a DB corruption that once we corrected sped up the searches significantly. 

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community