Splunk Enterprise Security

How can I accelerate my DataModel Query below to work better for an Alert?


I am trying to speed up my data model search for an alert that checks every 5 minutes (for the last 5 minutes) for "excessive" blocked inbound network connections (external IP's to the Internal RFC1918 IP space" I have the searching working just with the Data Model, but it still seems slow. Is there any way I can speed this up?

| `datamodel("Network_Traffic", "All_Traffic")` 
| search All_Traffic.action="blocked" (All_Traffic.dest= OR All_Traffic.dest= OR All_Traffic.dest= AND NOT (All_Traffic.src="" OR All_Traffic.src="" OR All_Traffic.src="") 
| stats count dc(All_Traffic.dest) as dest_count, values(All_Traffic.dest) as "Destination IP" by All_Traffic.action, All_Traffic.src  | rename All_Traffic.action as "Action", All_Traffic.src as "Source IP"
| search count>150
0 Karma


Don't use |datamodel or the macro.... use | tstats instead that is way faster! only downside for tstats is that you can't use a cidr in your where.

your query whould become something like:

| tstats summariesonly=t count dc(All_Traffic.dest) as dest_count, values(All_Traffic.dest) as dest from datamodel=Network_Traffic where All_Traffic.action="blocked" by All_Traffic.action, All_Traffic.src
| `drop_dm_object_name("All_Traffic")`
| search (dest= OR dest= OR dest= AND (src!="" src!="" 
| where count>150d
| rename dest AS "Destination IP", action as "Action", src as "Source IP"

more info on tstats: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

0 Karma