Splunk Search

Splunk query

Communicator

I need to search whether a set of ips (say 15 to 20 ips) are present in all the events (no specific index,source,sourcetype) for the past 7 days.

  1. I run a simple search,

index=* "a.b.c.d" OR "d.e.f.g" OR "d.s.d.d" ....

Then I extract a multivalue field to extract the ip wherever present in the event.

index=* universalip="a.b.c.d" OR "d.e.f.g" OR "d.s.d.d" ....

It consumes much time. Is there any way to optimize the query?

Thanks in advance.

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi splunkn,

any search containing either specific index,source or sourcetype will be faster; take a look at this great answer here http://answers.splunk.com/answers/172275/how-do-optimizations-for-field-based-searches-work.html

Also, search like this might be a bit faster:

index=* universalip="a.b.c.d" OR universalip="d.e.f.g" OR universalip="d.s.d.d"

But still, try to use any specific index or source or sourcetype in your base search and it will be much faster.

cheers, MuS

View solution in original post

SplunkTrust
SplunkTrust

Hi splunkn,

any search containing either specific index,source or sourcetype will be faster; take a look at this great answer here http://answers.splunk.com/answers/172275/how-do-optimizations-for-field-based-searches-work.html

Also, search like this might be a bit faster:

index=* universalip="a.b.c.d" OR universalip="d.e.f.g" OR universalip="d.s.d.d"

But still, try to use any specific index or source or sourcetype in your base search and it will be much faster.

cheers, MuS

View solution in original post

Communicator

Thanks MuS, anyway I want to search the whole data what I received. So I am not able to specify particular index/source/sourcetype here. Is there any other option?

0 Karma

SplunkTrust
SplunkTrust

One possible way to speed it up, you can limit / specify the indexes which are search by default for the users role http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Addandeditroles but then on the other hand, you're not searching the whole data.....

0 Karma