topic Re: Splunk query in Splunk Search

Splunk query

splunkn — Fri, 09 Jan 2015 08:06:44 GMT

I need to search whether a set of ips (say 15 to 20 ips) are present in all the events (no specific index,source,sourcetype) for the past 7 days.

I run a simple search,

index=* "a.b.c.d" OR "d.e.f.g" OR "d.s.d.d" ....

Then I extract a multivalue field to extract the ip wherever present in the event.

index=* universalip="a.b.c.d" OR "d.e.f.g" OR "d.s.d.d" ....

It consumes much time. Is there any way to optimize the query?

Thanks in advance.

Re: Splunk query

MuS — Fri, 09 Jan 2015 08:13:03 GMT

Hi splunkn,

any search containing either specific index,source or sourcetype will be faster; take a look at this great answer here http://answers.splunk.com/answers/172275/how-do-optimizations-for-field-based-searches-work.html

Also, search like this might be a bit faster:

index=* universalip="a.b.c.d" OR universalip="d.e.f.g" OR universalip="d.s.d.d"

But still, try to use any specific index or source or sourcetype in your base search and it will be much faster.

cheers, MuS

Re: Splunk query

splunkn — Fri, 09 Jan 2015 09:21:57 GMT

Thanks MuS, anyway I want to search the whole data what I received. So I am not able to specify particular index/source/sourcetype here. Is there any other option?

Re: Splunk query

MuS — Fri, 09 Jan 2015 10:28:39 GMT

One possible way to speed it up, you can limit / specify the indexes which are search by default for the users role http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Addandeditroles but then on the other hand, you're not searching the whole data.....