Differences between index and archive searches

Archive searches can take significantly longer to run than indexed searches, but the results are stored in the archive search index page and can be reviewed at any time. Other differences are listed below.

Both archive and index searches:

Provide aggregation data for groupby transforms that are defined in the search query. For more information, see the TQL Reference Guide.
Allow results to be displayed in a custom table form (whether or not a table is defined in the search query).
Provide aggregation data for all results, even if the results limit has been reached and result events themselves are not viewable in the UI.

Although archive searches cannot do the following things, index searches can:

Allow groupby fields to be set through the search results sidebar.
Provide data for the histogram that displays hits over time and can be displayed in the search results for index searches.
Sort or export results.
Support the class field as an array. Archive search doesn’t support class arrays, so if you pass a list of values (for example, class:[a,b,c]) only the first value is considered in the search. For archive search you must run one class per search.

Note that rawmsg and plain text queries tend to show significantly different result counts when comparing index search result counts with archive search result counts for the same time period.

Note
Regular expression (regex) operations can be performed against a maximum of 50,000 events for each index search in Helix Enterprise. To perform regex operations against larger datasets, you must filter search results to fewer than 50,000 events. Otherwise, the search will not complete successfully.