I use the “Contained” by query in relevance on occasion to go through a list of systems to see if they should be applicable.
While working on it the other day, i plugged it into the debugger and was surprised to see it took longer to evaluate than using the OR statements.
Can someone explain to me why this method is constantly a longer evaluation time?
Offhand, the difference isn’t the OR statements so much as capturing computer name once vs many times. Another variation might be:
q: exists computer name whose (it = "foo" or it="bar")
This should be closer to your tuple example.
Q: computer name = "foo" or computer name = "bar"
A: False
T: 138
I: boolean
Q: computer name is contained by set of ("foo";"bar")
A: False
T: 117
I: boolean
Q: exists computer name whose (it = "foo" or it = "bar")
A: False
T: 118
I: boolean
As the list gets longer, you get more separation from techniques.
Q: computer name = "Enterprise" or computer name = "Voyager" or computer name = "Defiant" or computer name = "Discovery" or computer name = "Reliant" or computer name = "Excelsior" or computer name = "Titan" or computer name = "Prometheus" or computer name = "Cerritos" or computer name = "Shenzhou"
A: False
T: 436
I: boolean
Q: computer name is contained by set of ("Enterprise";"Voyager";"Defiant";"Discovery";"Reliant";"Excelsior";"Titan";"Prometheus";"Cerritos";"Shenzhou") A: False
T: 127
I: boolean
Q: exists computer name whose (it = "Enterprise" or it = "Voyager" or it = "Defiant" or it = "Discovery" or it = "Reliant" or it = "Excelsior" or it = "Titan" or it = "Prometheus" or it = "Cerritos" or it = "Shenzhou")
A: False
T: 118
I: boolean
Also remember: The Windows Debugger has this weird thing where the individual operations sum together, from the bottom up. To really show their results, you need each variation on a separate tab.
@atlauren thanks for the info.
We do have some site relevance that can be pretty long. As we are multi-tenant, as customers deconvert from our services, we have a site we put their unique ID into. This way, if they have some systems that did not get the client removed, when they call in over our internet facing relay, we can revoke their certificate. I think there are 30 in there now. 