Splunk Search

How to run/optimize long ad-hoc searches with lookup

dauren_akilbeko
Communicator

I'm trying to see if there are hits with Kaseya related domains in my Web datamodel. As I understand we need to use wildcard lookup or trim Web.url to match domains in  the lookup Splunk-REvil-Kaseya-IOCs/domains.csv at main · davisshannon/Splunk-REvil-Kaseya-IOCs (github.com)

What I've tried so far:

 

| tstats summariesonly=true latest("_time") values("Web.src") values("Web.dest") from datamodel="Web"."Web" by "Web.url" "Web.user"
| eval list="*"
| `ut_parse(Web.url, list)`
| lookup kaseya_domains domain AS ut_domain OUTPUT domain
| where isnotnull('domain')

 


It works, but not for a longer period of times (7 days or more). What are my options?

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

When it doesn't work, what happens?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

dauren_akilbeko
Communicator

It times out or DAG errors.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!