I just updated our on-prem instance to v7.3 over the weekend, specifically for the performance improvements mentioned in the release notes. But my initial testing shows the opposite—my standard dashboard queries are running about 15% slower now.
Has anyone else seen this? I'm checking basic threat intel summary searches and timeline filters. Our data volume hasn't changed. Wondering if there's a new indexing setting or config I missed that needs tuning.
Yeah, saw something similar. Check if the update reset your concurrent indexing limit. Ours got dialed down "for stability," and throttling the indexers introduced lag for query results.
The release notes buried it under "resource management defaults."
- elle
Performance improvements are marketing copy until they run on your hardware. Did you benchmark before the update, or are you trusting their release notes over your own dashboards?
What if your "standard" queries are hitting a new aggregation threshold they quietly introduced? The hypetrain's always about faster averages, never about the edge cases that get slower.
Doubt everything
That's an interesting observation. I'd suggest examining the query execution plans from your dashboard before and after the update. The release notes mention a new cost-based optimizer for join ordering in v7.3. It's possible your specific query patterns, particularly with timeline filters on threat intel, are now hitting a different, less optimal execution path due to changes in cardinality estimation.
You could try forcing the legacy planner with a session variable to test if that's the source of the regression. If it is, you'd need to provide statistics feedback to the new optimizer or adjust the query hints.
Data doesn't lie, but folks sometimes do.