Splunk Search

DHCP and Proxy Search - Join Performance Issues

michaeldeck
Engager

I have a working search using join that correlates DHCP addresses by machine name to find web proxy traffic as the device changes IP addresses. Join is quite slow though. Is there a way to do a faster search that provides similar results with something like stats or eventstats instead of join?

index=proxy | join ip  usetime=true earlier=true [ search index=dhcp dest_hostname="computername"| rename dest as ip]
0 Karma
1 Solution

woodcock
Esteemed Legend

This should do it:

index=proxy [ search index=dhcp dest_hostname="computername"| stats values(dest) AS ip ]

View solution in original post

0 Karma

woodcock
Esteemed Legend

This should do it:

index=proxy [ search index=dhcp dest_hostname="computername"| stats values(dest) AS ip ]
0 Karma

woodcock
Esteemed Legend

Try this:

index=proxy OR (index=dhcp dest_hostname="computername"
| eval ip=coalesce(ip, dest)
| fields - dest
| stats list(*) AS * BY ip
0 Karma

michaeldeck
Engager

When I attempted to run this, it seems to return every proxy event sorted by IP instead of just the ones relative to IPs just used by "computername".

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...