Hi Dears,
When I search only IPs without field names in Firewall indexes search is fast, like:
index="EX" "X.X.X.X" OR "X.X.X.X" OR X.X.X.X" OR X.X.X.X" OR X.X.X.X"
But when I include field name as in below, the search takes a lot of time specially in Firewall index. (Though I believe it should take less time from above search because it searches for only specific field).
index="EX" dest_ip="X.X.X.X"OR dest_ip="X.X.X.X" OR dest_ip="X.X.X.X" OR dest_ip="X.X.X.X" OR dest_ip="X.X.X.X"
Please your support.
Best Regards,
