Update or Delete on Shared Extracted fields take a long time in vRealize Log Insight 3.x and up

Products

• VMware Aria Suite

Issue/Introduction

Symptoms:

• There is a large number of users in vRealize Log Insight.
• Updating or deleting a shared Extracted field takes a long time to complete.
• Updating or deleting a non shared Extracted field completes quickly.

Environment

VMware vRealize Log Insight 4.7.x
VMware vRealize Log Insight 4.0.x
VMware vRealize Log Insight 4.6.x
VMware vRealize Log Insight 3.0.x
VMware vRealize Log Insight 4.5.x
VMware vRealize Log Insight 3.3.x
VMware vRealize Log Insight 4.x
VMware vRealize Log Insight 4.3.x
VMware vRealize Log Insight 3.x
VMware vRealize Log Insight 3.6.x

Cause

When a shared Extracted field is updated or deleted, vRealize Log Insight is trying iterate over all users, find and update dependencies of that field in users' dashboards, queries, etc.
This process is quick for a small number of users, but takes a long time for a large number of users.

Resolution

This is a known issue affecting vRealize Log Insight 3.x and up.
Currently, there is no resolution.
This issue will be addressed in an upcoming release of vRealize Log Insight.

Workaround:
Updating or deleting a shared Extracted field will not fail. The current workaround is to let the task complete, which may take hours, depending on the amount of users in vRealize Log Insight.

Additional Information

To be alerted when this article is updated, click the subscribe button [cid:[email protected]] . For more information on KB subscription features, see the Knowledge Base Article FAQs: How to Subscribe to VMware Knowledge Base Articles (76417).