Splunk Search

request optimization with best practices

jip31
Motivator

hello

I use the request below but i would like to have an example of doing this code more performant following splunk best practices
could you help me please?

 index="windows" sourcetype="wineventlog:Application" SourceName="*" 
Type="Critique" OR Type="Avertissement" OR Type="Erreur" 
| dedup host 
| stats count by host   

| join host [search index="windows-wmi" sourcetype="WMI:ModelPC" |rex "Model=(?<model>.*)"|stats values(model) as Model by host]
| stats count values(host) by Model | rename count as Total | table Model Total | sort -Total limit=10
0 Karma
1 Solution

koshyk
Super Champion

Please try like below ( I haven't tested it, but just the concept)

[index="windows" sourcetype="wineventlog:Application" SourceName="*"  (Type="Critique" OR Type="Avertissement" OR Type="Erreur" ) | stats count by host | fields host]   index="windows-wmi" sourcetype="WMI:ModelPC"  
|rex "Model=(?<model>.*)"|stats values(model) as Model by host

View solution in original post

0 Karma

koshyk
Super Champion

Please try like below ( I haven't tested it, but just the concept)

[index="windows" sourcetype="wineventlog:Application" SourceName="*"  (Type="Critique" OR Type="Avertissement" OR Type="Erreur" ) | stats count by host | fields host]   index="windows-wmi" sourcetype="WMI:ModelPC"  
|rex "Model=(?<model>.*)"|stats values(model) as Model by host
0 Karma

jip31
Motivator

thanks a lot

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...