Splunk Search

Optimize Nested Search

Path Finder

This search is slow (our dns logs are large).

index=winlogs sourcetype=dns | eval dottedquestion=replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1") | search [| inputlookup baddomains | return 10000 dottedquestion=Domain]

Outside of shrinking the time window (I am not interested in going under 24 hours) is there anyway to optimize it? The baddomains list is very small (<1000)

Thank you in advance.

0 Karma

Motivator

Probably join might help you.

index=winlogs sourcetype=dns 
| eval Domain=replace(replace(questionname,"\(\d+\)","."),"\.(.*)\.","\1") 
| join type=inner Domain 
    [| inputlookup baddomains 
    | table Domain]

Also, if it's ad-hoc search, Run in 'Fast Mode' instead of 'Verbose Mode'.

0 Karma

Builder

If you're not counting and just looking for presence, try a "dedup dottedquestion" just before the | search.

0 Karma

Motivator

Can you share some sample pattern for questionname field?

0 Karma

Path Finder

Sure - apparently ms logs dns in “pascal style” string format. Showing the length of each next section in parens ending in (0).

(12)somecomputer(6)domain(3)com(0)

Defined in 4.1.2 of the RFC1035:
https://tools.ietf.org/html/rfc1035

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!