I'm trying to run a search for a large number (45) of suspect IP addresses. The search runs for 12 hours or more but never returns any results, and on the jobs page always shows "Running (0%)".
earliest=06/01/2011:0:0:0 NOT deny ("220.127.116.11" OR "18.104.22.168" OR "22.214.171.124" OR . . . ) |outputcsv 201107111.csv
Using outputcsv because I'm expecting more than 10K results based on individual searches on some of the addresses.
I know this is an inefficient and expensive search, but it seems that it should eventually complete.
A guy I work with changed the ("IP....s") to the next stage and did a regex he was fortunate that all his IPs where near the same area.
<search> | regex _raw="10.(8.(43.5|52.4)|9.(232.4|144.(4|33))" | <presentation>
he is good with RegEx and the above is easy to add an remove, for those who can read it.
Run from the cli without the outputcsv pipe, the search finishes in a few minutes, but results are incomplete due to the "head 100" that is appended by dispatch.
With the outputcsv pipe the search has now run 14 hours with no results.
Comes back in about 10 seconds with no results when run with search command and saved search. When run with the full search string via the dispatch command . . . still processing. I see on the jobs page that "| head 100 | export" has been added to the search? Will post results tomorrow or when finished.