Splunk Search

DHCP and Proxy Search - Join Performance Issues

michaeldeck
Engager

I have a working search using join that correlates DHCP addresses by machine name to find web proxy traffic as the device changes IP addresses. Join is quite slow though. Is there a way to do a faster search that provides similar results with something like stats or eventstats instead of join?

index=proxy | join ip  usetime=true earlier=true [ search index=dhcp dest_hostname="computername"| rename dest as ip]
0 Karma
1 Solution

woodcock
Esteemed Legend

This should do it:

index=proxy [ search index=dhcp dest_hostname="computername"| stats values(dest) AS ip ]

View solution in original post

0 Karma

woodcock
Esteemed Legend

This should do it:

index=proxy [ search index=dhcp dest_hostname="computername"| stats values(dest) AS ip ]
0 Karma

woodcock
Esteemed Legend

Try this:

index=proxy OR (index=dhcp dest_hostname="computername"
| eval ip=coalesce(ip, dest)
| fields - dest
| stats list(*) AS * BY ip
0 Karma

michaeldeck
Engager

When I attempted to run this, it seems to return every proxy event sorted by IP instead of just the ones relative to IPs just used by "computername".

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...