Using IT Security Search for my Change Auditor data. It's working, but I have a question about search performance. If I do this search: "(What="member added to group" OR What="member removed from group") AND Source="ChangeAuditor" for the last 7 days, it takes about 20-30 seconds to return results that go back 7 days. But the 'Search' button shows running for another 2 minutes. The longer the date range, the worse it is. All the results seem to be returned in a reasonable amount of time, but then it appears to continue searching, but not returning any more results.
原因
ITSS has a on search on all fields. But Change Auditor is not designed for “Full text search” you can only perform fast search on the indexed fields.
That’s why ITSS launches two searches one is fast with index search (What field is indexed) and another slow – on all the rest of the data. This mechanism is way the product is designed to work.
解决办法
None this is the way the product is designed to work please look at Cause.