Hit searching takes 30+ seconds for any particular query.
* Use of content search, especially phrase search.
* Using default search parameters.
* Archiver is under heavy capture or search load.
* Archiver is "cold" due to recent restart.
* Several slow searches are running concurrently.
FEV FG - Foglight Experience Viewer Field Guide
1) The archiver may be slow to respond to queries right after startup. Run a few more queries and see if performance improves as the appliance warms up.
2) The slowest hit queries are often those with relatively few constraints. (The worst can be the default New query, because only the time is constrained.) Specifying additional search terms, including status, type, server, path, fields, or headers, generally improves search performance.
3) Increase the time range for the hit query. Searching a narrow time range often takes longer than wider time ranges.
4) If the hit search is performing a content phrase search, then restate the query using boolean words. (Phrase searching is known to be slow.)
Phrase search: "A B C"
Equivalent Boolean word search: +A +B +C
5) If performing a Boolean word search, then restate the query in terms of a field or header. (Content text searching is slow compared to structured queries.)
6) Try to reduce the use of wildcards in the search terms. Hit searching will be very slow when the search term begins with a wildcard, or has a wildcard within the search term.
Mixed wildcards (slowest): *foo*
Leading wildcard (very slow): *foo
Interior wildcard (slow): fo*o
Trailing wildcard (better): foo*
Exact search term (fastest): foo
7) Try your search again later when capture load is lower, or when fewer users are also submitting queries.
8) Verify that hits are not being discarded, as described in section 3.2.3. Contact Support
for help if poor query performance is causing incoming hits to be discarded.
* Wildcarding at start of search term
* Searching a relatively narrow time range