https://community.splunk.com/t5/Splunk-Search/How-to-optimize-this-search/m-p/600223#M208953 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/243242">@Woodpecker</a>,</P><P>at first, the index condition is wrong, you should have</P><LI-CODE lang="markup">(index=a OR index=b)</LI-CODE><P>Then, if your lookups don't change frequently and the number of IPs in lookups are less than 50,000, you could schedule a search that creates one lookup to use in the search, deduping the values and reducing in this way the occurrences to check.</P><P>Then you could use a KV-Store for your lookup to have better performaces.</P><P>Then the last dedup isn't mandatory.</P><P>In general your search isn't bad, but, if you have too many events in indexes "a" and "b", you could use a summary index in which you could store only the src_ips to test from your indexes, in this way you'll surely have a much more performant search.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 02 Jun 2022 06:45:52 GMT gcusello 2022-06-02T06:45:52Z https://community.splunk.com/t5/Splunk-Search/How-to-optimize-this-search/m-p/600217#M208950 <P>Hi,<BR /><BR />I have an SPL, which should exclude the ip values from 4 lookups. So i tried it with a subsearch approach. But this search takes a longer time than usual to run.&nbsp; How can I optimize it?</P><P>&nbsp;</P><LI-CODE lang="markup">index=a OR b action=* attack!=N/A NOT (( [| inputlookup a.csv | fields ip | rename ip as srcip]) OR ( [| inputlookup b.csv | fields ip | rename ip as src_ip]) OR ( [| inputlookup c.csv | fields ip | rename ip as src_ip]) OR ( [| inputlookup d.csv | fields ip | rename ip as src_ip])) | stats dc(attack) as dc_attack by src_ip | where dc_attack &gt;2 | dedup src_ip</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>Thanks in advance!</P> Thu, 02 Jun 2022 05:41:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-optimize-this-search/m-p/600217#M208950 Woodpecker 2022-06-02T05:41:59Z https://community.splunk.com/t5/Splunk-Search/How-to-optimize-this-search/m-p/600223#M208953 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/243242">@Woodpecker</a>,</P><P>at first, the index condition is wrong, you should have</P><LI-CODE lang="markup">(index=a OR index=b)</LI-CODE><P>Then, if your lookups don't change frequently and the number of IPs in lookups are less than 50,000, you could schedule a search that creates one lookup to use in the search, deduping the values and reducing in this way the occurrences to check.</P><P>Then you could use a KV-Store for your lookup to have better performaces.</P><P>Then the last dedup isn't mandatory.</P><P>In general your search isn't bad, but, if you have too many events in indexes "a" and "b", you could use a summary index in which you could store only the src_ips to test from your indexes, in this way you'll surely have a much more performant search.</P><P>Ciao.</P><P>Giuseppe</P> Thu, 02 Jun 2022 06:45:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-optimize-this-search/m-p/600223#M208953 gcusello 2022-06-02T06:45:52Z