https://community.splunk.com/t5/Splunk-Search/How-to-run-optimize-long-ad-hoc-searches-with-lookup/m-p/558683#M158726 <P>It times out or DAG errors.</P> Thu, 08 Jul 2021 13:08:27 GMT dauren_akilbeko 2021-07-08T13:08:27Z https://community.splunk.com/t5/Splunk-Search/How-to-run-optimize-long-ad-hoc-searches-with-lookup/m-p/558652#M158709 <P>I'm trying to see if there are hits with Kaseya related domains in my Web datamodel. As I understand we need to use wildcard lookup or trim Web.url to match domains in&nbsp; the lookup <A href="https://github.com/davisshannon/Splunk-REvil-Kaseya-IOCs/blob/main/domains.csv" target="_blank" rel="noopener">Splunk-REvil-Kaseya-IOCs/domains.csv at main · davisshannon/Splunk-REvil-Kaseya-IOCs (github.com)</A>.&nbsp;<BR /><BR />What I've tried so far:</P><P>&nbsp;</P><LI-CODE lang="markup">| tstats summariesonly=true latest("_time") values("Web.src") values("Web.dest") from datamodel="Web"."Web" by "Web.url" "Web.user" | eval list="*" | `ut_parse(Web.url, list)` | lookup kaseya_domains domain AS ut_domain OUTPUT domain | where isnotnull('domain')</LI-CODE><P>&nbsp;</P><P><BR />It works, but not for a longer period of times (7 days or more). What are my options?</P> Thu, 08 Jul 2021 08:03:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-optimize-long-ad-hoc-searches-with-lookup/m-p/558652#M158709 dauren_akilbeko 2021-07-08T08:03:34Z https://community.splunk.com/t5/Splunk-Search/How-to-run-optimize-long-ad-hoc-searches-with-lookup/m-p/558682#M158725 <P>When it doesn't work, what happens?</P> Thu, 08 Jul 2021 13:06:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-optimize-long-ad-hoc-searches-with-lookup/m-p/558682#M158725 richgalloway 2021-07-08T13:06:01Z https://community.splunk.com/t5/Splunk-Search/How-to-run-optimize-long-ad-hoc-searches-with-lookup/m-p/558683#M158726 <P>It times out or DAG errors.</P> Thu, 08 Jul 2021 13:08:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-run-optimize-long-ad-hoc-searches-with-lookup/m-p/558683#M158726 dauren_akilbeko 2021-07-08T13:08:27Z