Event View Slow When Using Advanced Filter
When you use the advanced options to filter an Event View connection it is extremely slow to pull up any records. I created two Event Views that look at the exact same 2 event id's (the first one is using the advanced view and the second is using a range). The one using the advanced filter takes over two minutes to pull up the records and the one without the advanced filter takes seconds. I'm using the Local Execution for these views not a Royal server. Is it just slow due to executing a different query or is there something else going on?
glad we could help!
Putting the query in brackets has definitely fixed the slowness. The query now executes just as fast as the other one.
Thanks for the help and an awesome product with amazing support.
we tracked this one down - thanks for the feedback.
basically it is because of how WMI evaluates the logic query expression.
as a fix, it might help, if you put your query in the Advanced Tab in brackets like this
(EventCode=1000 or EventCode=1001)
A general fix for this issue will be included our next versions of Royal TS V3 beta (for Windows) and Royal TSX V2 beta (for OS X).
I don't see the complete query. Can you post a screenshot or the complete query from the filter - preview panel (under Advanced)?
I'm wondering if you are limiting the results using a relative or absolute time filter...
Sure, they query is actually pretty simple:
EventCode=2501 OR EventCode=2502
The other duplicate view just uses the between operator and enters 2501 as the beginning and 2502 as the end.
I have one other that is:
EventCode=6312 OR EventCode=3632 OR EventCode=3989
It runs just as slowly as the first one.
can you post your queries? My guess is that WMI just needs more time to query the data but I'm happy to double-check.