kroepke
commented
9 years ago Graylog always searches in the current write index, because it does not store metadata about that index. The delay is probably due to loading field data.
We will see if we can change this alongside with the issue reported about the index ranges problem (don't have the issue number at hand). On Apr 28, 2015 1:20 PM, "runningman84" notifications@github.com wrote:
Our big system hosts 10+ TB data. This allows us to look back about 12 days.
If I search using a time range like a 2015-04-01 00:00:00.000 +00:00 - 2015-04-02 00:00:00.000 +00:00. Graylog needs several seconds to execute this search. Why is graylog doing a search at all if it knows that the index data doesn't last longer than 12 days. (the first message appears at 2015-04-16 00:00:00.000 +00:00).
Furthermore I would like to see a hint that my search did not give any results due to not having any data before 2015-04-16 00:00:00.000 +00:00.
— Reply to this email directly or view it on GitHub https://github.com/Graylog2/graylog2-web-interface/issues/1238.
Our big system hosts 10+ TB data. This allows us to look back about 12 days.
If I search using a time range like a 2015-04-01 00:00:00.000 +00:00 - 2015-04-02 00:00:00.000 +00:00. Graylog needs several seconds to execute this search. Why is graylog doing a search at all if it knows that the index data doesn't last longer than 12 days. (the first message appears at 2015-04-16 00:00:00.000 +00:00).
Furthermore I would like to see a hint that my search did not give any results due to not having any data before 2015-04-16 00:00:00.000 +00:00.