Splunk Enterprise Security

Improve search performance

shaquibk
Explorer

Hi All,

I need to improve the performance of my below search, which currently completes in about 132sec. The search looks for last 7 days data from firewall logs. 

Search:

index="xxx" src_ip !="a.b.c.d/26" src_ip !="x.y.z.w/26" src_zone!=ABCD src_zone!=ABCDE (dest_zone = "ABCD" OR (dvc_name IN ("qwerty","abcd","xyz","asdf") AND dest_zone="XYZ")) app IN (ldap,rmi-iiop) | lookup some_lookup ip as src_ip OUTPUT matched | search matched!="yes" | stats count by src_ip,action,date_mday | stats count by src_ip,action | search (action=allowed OR (action=blocked AND count>1))

 

Thanks in advance.

Regards,

Shaquib

Labels (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @shaquibk,

You can try below, I changed lookup method;

index="xxx" src_ip !="a.b.c.d/26" src_ip !="x.y.z.w/26" src_zone!=ABCD src_zone!=ABCDE (dest_zone = "ABCD" OR (dvc_name IN ("qwerty","abcd","xyz","asdf") AND dest_zone="XYZ")) app IN (ldap,rmi-iiop) 
    [| inputlookup some_lookup 
    | fields ip 
    | rename ip as src_ip 
    | format ] 
| stats count by src_ip,action,date_mday 
| stats count by src_ip,action 
| search (action=allowed OR (action=blocked AND count>1))

 

If this reply helps you an upvote is appreciated.
0 Karma

shaquibk
Explorer

Hi @scelikok 

The below method somehow doesn't return any results at all.

Thanks,

Shaquib

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

maybe you should use this https://docs.splunk.com/Documentation/CIM/5.0.0/User/Overview with data model acceleration? There is https://docs.splunk.com/Documentation/CIM/5.0.0/User/NetworkTraffic for this kind of use.

r. Ismo

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...