Splunk Search

DHCP and Proxy Search - Join Performance Issues

michaeldeck
Engager

I have a working search using join that correlates DHCP addresses by machine name to find web proxy traffic as the device changes IP addresses. Join is quite slow though. Is there a way to do a faster search that provides similar results with something like stats or eventstats instead of join?

index=proxy | join ip  usetime=true earlier=true [ search index=dhcp dest_hostname="computername"| rename dest as ip]
0 Karma
1 Solution

woodcock
Esteemed Legend

This should do it:

index=proxy [ search index=dhcp dest_hostname="computername"| stats values(dest) AS ip ]

View solution in original post

0 Karma

woodcock
Esteemed Legend

This should do it:

index=proxy [ search index=dhcp dest_hostname="computername"| stats values(dest) AS ip ]
0 Karma

woodcock
Esteemed Legend

Try this:

index=proxy OR (index=dhcp dest_hostname="computername"
| eval ip=coalesce(ip, dest)
| fields - dest
| stats list(*) AS * BY ip
0 Karma

michaeldeck
Engager

When I attempted to run this, it seems to return every proxy event sorted by IP instead of just the ones relative to IPs just used by "computername".

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...