Add support for creating new signals without re-indexing all data

[DanAvni]

I have 2TB+ of events and need to create a new signal. I do not care about filtering events earlier than now as I know they are not relevant and/or do not exist. When I create the new signal, all data is re-indexed, which is a huge waste of time as it takes days to complete. Please add support for adding a signal without re-indexing of old data.

[liammclennan]

Hi @DanAvni ,

Thanks for the suggestion. I have a few questions to help me understand.

Q1. If signals do not index the log, what do they do? Is it a way to save a search expression?

Q2. If what you want is saved searches, have you tried pinning the search in the HISTORY window?

Thanks.

[DanAvni]

Hi @liammclennan

Maybe I wasn't clear so let me explain:
The new signals do index the log but they will only index new data and not existing data. The idea is to skip the indexing of the existing 2TB of data as I know the signal will not find anything there.

[liammclennan]

Thanks for the clarification.

[DanAvni]

Hi @liammclennan, Any chance this will be added soon? My data has grown to over 6TB of logs and I am in the process of adding a new property to events that I will need to filter upon. When I will add a signal on the new property it will be a waste of CPU/Disk time indexing all the events as nothing contains it.

[liammclennan]

Hi @DanAvni

It is not planned at the moment. The team is currently busy building distributed queries for Seq clusters.