Enabling payload indexing to optimize search times

You use the Quick Filter feature on the Log Activity and Network Activity tab to search event and flow payloads by using a text string. To optimize event and flow search times, enable payload indexing on the Quick Filter property.

Restriction: Payload indexing increases disk storage requirements and might affect system performance. Enable payload indexing if your deployment meets the following conditions:
  • The event and flow processors are at less than 70% disk usage.
  • The event and flow processors are less than 70% of the maximum events per second (EPS) or flows per interface (FPI) rating.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click Index Management.
  3. In the Quick Search field, type Quick Filter.

    The Quick Filter property is displayed.

  4. Select the Quick Filter property that you want to index.

    In the results table, use the value in the Database column to identify the events or flows Quick Filter property.

  5. On the toolbar, click Enable Index. A green dot indicates that the payload index is enabled.

    If a list includes event or flow properties that are indexed, the property names are appended with the following text: [Indexed].

  6. Click Save.

What to do next

To manage payload indexes, see Configuring the retention period for payload indexes.