topic How to optimize the current query? in Deployment Architecture

How to optimize the current query?

debjit_k — Fri, 16 Dec 2022 19:47:09 GMT

hope you are doing good.

im working on a use case which will trigger if any user is trying to connect from non business country.

attaching the snap for the query.

my query

want to optimize it more if one user is trying is log in from more than 2-3 country than it will trigger.

can you please help me with the query

thanks

debjit

Re: need to optimize the current query

gcusello — Sat, 10 Dec 2022 09:59:56 GMT

Hi @debjit_k,

the first possible optimization is to move the search "Keywords="*Audit Success*) in the main search and leave only the search for country at the end of the search.

Then, if possible, try a different string to search because to have asterisk at the beginning of a string isn't efficient.

Then what's the sense of use IP and other fields in a stats command and then dedup by IP, in this way you have a longer search and you loose (or not use) some information,

Then you could put iplocation command after the stats command.

so you could use a different stats:

Next time, please, don't share your search using a screenshot but put it as text in a Code Sample window.

Ciao.

Giuseppe

Re: need to optimize the current query

debjit_k — Sat, 10 Dec 2022 10:46:04 GMT

Hi @gcusello,

thank you for the updated query but im looking for a query which will only trigger if a single is log from 2 different country

example

ip user country

10.0.0.0 debjit india

10.0.0.0 debjit japan

can you please help me to fig out the above solution

thanks

debjit

Re: need to optimize the current query

gcusello — Sat, 10 Dec 2022 10:53:04 GMT

Hi @debjit_k,

please try something like this:

please, next time share your search as text!

Ciao.

Giuseppe