vRealize Log Insight 8 very slow

[seamusobr1]

We have a six node Log Insight 8 cluster. with 6 nodes. All the nodes are configured as large and the ingestion rate is below 15,000 which is what is ok for these nodes

I have also ran some checks on the nodes for corrupt buckets

I have switched off the 1 alert we have just to see what the issue is

The problem is that simple queries grind to a halt to the point that it becomes unusable

I have checked the cluster nodes in vRops and cannot see evidence of hardware issues

Does anyone know of ways to improve query performance in log Insight

I have logged a call with GSS as well

Interestingly enough we did not seem to have the issues with 4.8

Any help would be greatly appreciated

[zyphein]

Same issue here and web interface need to wait for a few minutes to show up. 

[RickVerstegen]

Did you check the following?

1. Using very large time ranges in log searches
2. Slow or instable network

[danhyde7]

Did you ever resolve this issue? We needed to convert 3 years worth of a couple system's .evtx logs to .txt and import them in to vRealize using Log import (3 different instances of vRealize, 3 different networks). After performing this, the logs are in vRealize, but the cluster is SO SLOW to the point of being unusable. It takes so long to load a dashboard and sometimes it will even cause the VM to crash. The only thing I've seen to try is removing 'corrupted buckets' and I'm not confident that will fix the issue. Going to try creating new instances, configure them, and import only 1 years' worth of logs. (BTW the storage capacity is fine on all 3 vRealize instances, one was at 96%, but i added another virtual drive.)