https://community.splunk.com/t5/Getting-Data-In/Sub-Searching-tstats/m-p/431071#M95845 <P>Drop the sub search. Use a lookup running on indexers.</P> <P>Use fields instead of table.</P> Sat, 22 Dec 2018 00:37:28 GMT valiquet 2018-12-22T00:37:28Z https://community.splunk.com/t5/Getting-Data-In/Sub-Searching-tstats/m-p/431070#M95844 <P>Hello,</P> <P>I have a query for returning blocked data from our firewall to Google's DNS Servers - I now want to correlate this with data from our proxy to attempt to identify the user logged onto the machine. What I have written is below:</P> <P>| tstats summariesonly=t count as Count, dc(fw.rule) as dc_rules, values(fw.rule) as rules, max(_time) as LastSeen, values(fw.dest_ip) as Destination FROM datamodel=Firewall.fw WHERE fw.dest_ip = 8.8.4.4 OR fw.dest_ip = 8.8.8.8 AND fw.action = "blocked" BY fw.src_ip, fw.action | rename src_ip as src_host | join srch_host [ search index=proxy | fields src_host,UserName] | table src_host,Destination,action,UserName,Count</P> <P>The proxy index is quite data heavy so ideally I would like to set the search to have src_host as the src_host identified in the parent query. Could anyone help a.) Streamline the query to improve performance and b.) help me get it working!</P> <P>Many Thanks</P> Tue, 29 Sep 2020 22:22:07 GMT https://community.splunk.com/t5/Getting-Data-In/Sub-Searching-tstats/m-p/431070#M95844 griggsy 2020-09-29T22:22:07Z https://community.splunk.com/t5/Getting-Data-In/Sub-Searching-tstats/m-p/431071#M95845 <P>Drop the sub search. Use a lookup running on indexers.</P> <P>Use fields instead of table.</P> Sat, 22 Dec 2018 00:37:28 GMT https://community.splunk.com/t5/Getting-Data-In/Sub-Searching-tstats/m-p/431071#M95845 valiquet 2018-12-22T00:37:28Z