Event or flow data not indexed

Explanation

If too many indexes are enabled or the system is overburdened, the system might drop the event or flow from the index portion.

User response

Select one of the following options:

• If the dropped index interval occurs with SAR sentinel notifications, the issue is likely due to system load or low disk space.
• To temporarily disable some indexes to reduce the system load, on the Admin tab, click the Index Management icon.