Splunk Search

What is the best way to do this in Splunk? Tags? Lookup or perhaps something else?

Path Finder


I have a complex search that I need to do.

An example is something like:

CONDITION=(ip.dst=lots of different IPs' && port=some interesting ports && ip.src != some more Ip's)

What I would like to know is when condition is true.

If I run this search over many events over a long period, then it will take a long time.

Is there anyway I can tag my events as they are being indexed so that I can do a search on CONDITION=True, so that searching just needs to lookup for some meta "CONDITION=true", rather than having to evaluate the whole condition against each event.

0 Karma


Looking at your query at a high level, seems that your underlying data can be mapped to Network Traffic datamodel and if that can be mapped, you can get DM acceleration and use tstats to run search for a longer time window with little to minimal impact on resources.

0 Karma


Hi @davidwaugh

So there are a few ways you could accomplish this (that I can think of):

  • INGEST_EVAL or creating Index-time meta tags: I don't think this is a great solution becuase it would be a bit of a headache maintaining the IPLIST etc in the props/transforms file.
  • Data Model acceleration - This would probably be my preference becuase it is can take care of data gaps by itself etc.

You could also maybe use a summary index or there are probably other good ways that people can think of.


0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...