Splunk Add-on for McAfee Web Gateway: why does a Splunk search run very slow when defined fields are used?

[cburgman]

Whenever I search McAfee Webgateway data using a defined field name ( sourcetype="mcafee:wg:kv" user=joeuser), the search takes several minutes to complete. However, if I remove the field name ( sourcetype="mcafee:wg:kv" joeuser), the search completes in a matter of seconds as expected. I have confirmed that the problem on occurs with the webgateway data. I am using Splunk Add-on for McAfee Web Gateway app and have not made any modifications. Any troubleshooting tips would be greatly appreciated as I am fairly new to Splunk. Let me know what other information is needed.

Splunk version 6.3.3
Splunk Add-on for McAfee Web Gateway version 1.0.0
Application installed on Search Heads, Heavy Forwards and to the Indexer Cluster

[jdeer0618 · Accepted solution]

Having this issue as well. Our solution was two pronged. First we adjusted the MWG log format XML. Then we got rid of all the useless EVALs that the TA was running.

Our MWG now sends the events with the fields already CIM'd. So now instead of having to change "dhost" to "dest_host" at search time, the gateway sends us "dest_host" It isn't perfect and I am sure we can do a lot more tweaking but just doing that made a huge difference.

Hope this helps

JD

[cburgman]

That is exactly what we did on our end as well. Runs a lot better now.

Thanks for the response!