Splunk Search

What is the best way to do this in Splunk? Tags? Lookup or perhaps something else?

davidwaugh
Path Finder

Hello,

I have a complex search that I need to do.

An example is something like:

CONDITION=(ip.dst=lots of different IPs' && port=some interesting ports && ip.src != some more Ip's)

What I would like to know is when condition is true.

If I run this search over many events over a long period, then it will take a long time.

Is there anyway I can tag my events as they are being indexed so that I can do a search on CONDITION=True, so that searching just needs to lookup for some meta "CONDITION=true", rather than having to evaluate the whole condition against each event.

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Looking at your query at a high level, seems that your underlying data can be mapped to Network Traffic datamodel and if that can be mapped, you can get DM acceleration and use tstats to run search for a longer time window with little to minimal impact on resources.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @davidwaugh

So there are a few ways you could accomplish this (that I can think of):

  • INGEST_EVAL or creating Index-time meta tags: I don't think this is a great solution becuase it would be a bit of a headache maintaining the IPLIST etc in the props/transforms file.
  • Data Model acceleration - This would probably be my preference becuase it is can take care of data gaps by itself etc.

You could also maybe use a summary index or there are probably other good ways that people can think of.

Cheers,

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...