Simplifying/combining queries

[OzzMann80]

Howdy, Im fairly new to splunk and couldnt google the answer I wanted to Here we go. 

I am trying to simplify my queries and filter down the search results better.

Current example query: 

index=myindex
| search (EventCode=4663 OR EventCode=4660) OR (EventID=2 OR EventID=3 OR EventID=11) OR (Processes="*del*.exe" OR Processes="*rm*.exe" OR Processes="*rmdir*.exe") process!="C:\\Windows\\System32\\svchost.exe" process!="C:\\Program Files\\Microsoft Advanced Threat Analytics\\Gateway\\Microsoft.Tri.Gateway.exe"  process!="C:\\Program Files\\Common Files\\McAfee\\*" process!="C:\\Program Files\\McAfee*" process!="C:\\Windows\\System32\\enstart64.exe" process!="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" process!="C:\\Program Files\\Windows\\Audio\\EndPoint\\3668cba\\cc\\x64\\AudioManSrv.exe"
| table  _time, source, subject, object_file_path, SubjectUserName, process, result

This is an just an example, I do this same way for multiple different fields, indexs 

I know its not the most efficient way of doing it but I dont know any better ways. Usually Ill start broad and whittle down the things I know I'm not looking for.  Is there either a way to simplify this (I could possibly do regex but im not really good at that) or something else like this to make my life easier? such as combining all the results I want to filter for one field.

Any and all help/criticism is appreciated.

[richgalloway · Accepted solution]

Not the most efficient way of doing what?

You could improve the performance of the query by combining the first two commands.

index=myindex (EventCode=4663 OR EventCode=4660) OR (EventID=2 OR EventID=3 OR EventID=11) OR (Processes="*del*.exe" OR Processes="*rm*.exe" OR Processes="*rmdir*.exe") process!="C:\\Windows\\System32\\svchost.exe" process!="C:\\Program Files\\Microsoft Advanced Threat Analytics\\Gateway\\Microsoft.Tri.Gateway.exe"  process!="C:\\Program Files\\Common Files\\McAfee\\*" process!="C:\\Program Files\\McAfee*" process!="C:\\Windows\\System32\\enstart64.exe" process!="C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" process!="C:\\Program Files\\Windows\\Audio\\EndPoint\\3668cba\\cc\\x64\\AudioManSrv.exe"
| table  _time, source, subject, object_file_path, SubjectUserName, process, result

Legibility can be improved a little by the IN operator.

index=myindex (EventCode=4663 OR EventCode=4660) OR (EventID=2 OR EventID=3 OR EventID=11) OR (Processes="*del*.exe" OR Processes="*rm*.exe" OR Processes="*rmdir*.exe") 
NOT process IN ("C:\\Windows\\System32\\svchost.exe" 
                "C:\\Program Files\\Microsoft Advanced Threat Analytics\\Gateway\\Microsoft.Tri.Gateway.exe" 
                "C:\\Program Files\\Common Files\\McAfee\\*" "C:\\Program Files\\McAfee*" 
                "C:\\Windows\\System32\\enstart64.exe" 
                "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" 
                "C:\\Program Files\\Windows\\Audio\\EndPoint\\3668cba\\cc\\x64\\AudioManSrv.exe")
| table  _time, source, subject, object_file_path, SubjectUserName, process, result

[OzzMann80]

Thats Pretty much exactly what I was looking for, Thank you.