I have a CSV file already located on our Splunk instance with about 20000 IP's. I would like to use this file to search against our indexed firewall events. I've tried using the join command, it does return some results, but it never finishes. Does anyone know another way to do this?
Thanks in advance.
I've seen this exact same use case before.. Don't use join, you need to use the lookup
command and you need to do the lookup after a transformational command like stats
for better performance.
Depending on runtime and size, you may also want to consider summarizing your data and having the lookup run against the summarized data to max out performance
I've seen this exact same use case before.. Don't use join, you need to use the lookup
command and you need to do the lookup after a transformational command like stats
for better performance.
Depending on runtime and size, you may also want to consider summarizing your data and having the lookup run against the summarized data to max out performance