I have two indexes including command line arguments, one has field name arg, the other one has field name command, what is the best practice to search some strings on both fields under different indexes to create alert if matches.
index=A arg="*command_string_to_search*"
OR
index=B command="*command_string_to_search*"
How can we improve this search from performance standpoint?
Thanks,
Hi @splunkerer
What you have written is fine as you have data in two different indexes. Fieldnames doesn't matter though they have common values as long as you have OR condition.
Couple of points to fine tune:
----
An upvote would be appreciated if this reply helps and Accept the solution!
Hi @splunkerer
What you have written is fine as you have data in two different indexes. Fieldnames doesn't matter though they have common values as long as you have OR condition.
Couple of points to fine tune:
----
An upvote would be appreciated if this reply helps and Accept the solution!
Thanks @venkatasri for all great recommendations.
I was thinking it may be useful to use rex in a field instead of using a couple of heavy string? what do you think on that?
| rex field=command "(string_1)|(string_2)|(string_3)|(strings_4)"
but the problem here is strings which will be searched can be anywhere of the field
@splunkerer | rex is for field extractions not for search. What you have written originally that is self sufficient though the command/arg values are long it does job well when you follow field = "value" rather than doing raw search.
if you think the fields match many sourcetypes/source under index=A OR B then specify the sourcetype= , source= , host= (this is fundamental searching a whole index takes time) the more details you put in upfront to SPL then results would be narrowed down and faster.