Vantage is designed to import everything from your log files, but if you are not interested in looking all of the fields available, then this could be slowing down your reports.
By default Vantage will import every field and every hit from your log files, however, most log files contain a lot of extra fields that you may not be interested in reporting on. By restricting the fields that are imported or filtering the data on import you can reduce the size of your Storages, and increase reporting speeds.
When you import your log files into a new storage, go to the Field Selection page of the wizard. This will display all of the schemas associated with your log format, and the fields for each schema. For example if you are importing Microsoft FTMG log files, you could be importing the firewall (FWS) log files, or the web proxy (WEB) log files, or both, and each log file has a different set of fields in it.
By default all of the fields are imported, however there could be fields in the list that you may never be interested in reporting on, such as Bidirectional or Malware Inspection Content Delivery. You can uncheck these fields and prevent them from being imported into your storage. To help you find the fields you want to eliminate you can use the View dropdown button (see screenshot, circle #1) to view the list by the Summaries as they appear in Vantage, or by the Fields as they come from the log file. For example, “Site” is a single field in the log file, so when the View dropdown is set to Fields you will only see “Site” in the list, but when this field is imported into Vantage it is split into 11 different Summaries such as Site Domain, Site Extension, Site Keyword, etc, so when the View dropdown is set to Summaries you will see all 11 options and could uncheck them separately. However if you uncheck Site Domain and leave the other 10 fields checked then the entire Site field would still need to be imported from the log file to populate Site Name and the other Summaries.
When you make changes to the Field Selection please ensure you make changes to the correct schema that you intend to import data for. For example there is no advantage in unchecking User in the Firewall schema, if you are only importing Web log files. Once you have made your changes you can also use the Saved button (see screenshot, circle #2) to save your selections, and recall these for a future storage.
To help you out with field selections, we have included a Basic button (see screenshot, circle #3) which will remove all non-essential fields, and leave you only with the most important fields that you may want to report on. Of course you can modify the selection after clicking the Basic button to include/remove any other fields you desire.
Field Selection Page
Please Note: Whatever fields you decide to import or remove, it’s essential for Vantage that you import the date and time fields (Views: Fields = DateTime). If this field is not imported, then the reports cannot work.
Leave A Comment