Add support for creating new signals without re-indexing all data

[DanAvni]

I have 2TB+ of events and need to create a new signal. I do not care about filtering events earlier than now as I know they are not relevant and/or do not exist. When I create the new signal, all data is re-indexed, which is a huge waste of time as it takes days to complete. Please add support for adding a signal without re-indexing of old data.

[liammclennan]

Hi @DanAvni ,

Thanks for the suggestion. I have a few questions to help me understand.

Q1. If signals do not index the log, what do they do? Is it a way to save a search expression?

Q2. If what you want is saved searches, have you tried pinning the search in the HISTORY window?

Thanks.

[DanAvni]

Hi @liammclennan

Maybe I wasn't clear so let me explain: The new signals do index the log but they will only index new data and not existing data. The idea is to skip the indexing of the existing 2TB of data as I know the signal will not find anything there.

[liammclennan]

Thanks for the clarification.