What fields are indexed by the log indexer? Can it be modified?

[George_Ellis]

Hi folks,

A lot of my work is validating rules and usage.  Almost all the time, I am using the Rule UID as part of the search string in the log search field.  Do we know if Rule UID is one of the indexes?  If not, do we know if there is a way to modify the indexer so it is included while indexing?

Problem space - I estimate we have well over 20TB of logs.  It takes longer to go though at least 60 days.

[Amir_Senn · Accepted solution]

Hi,

The following sk shows what fields are being indexed:

https://support.checkpoint.com/results/sk/sk144192

[George_Ellis]

I was searching for indexing and missed that.  So yes, already indexed.  As fast as it will go.  Sigh.