Is there any better query to search for a particular IOC (IP) across all indexes?

[ashokoban]

Hi,

Is there any better query to search for a particular IOC (IP) across all indexes.

I generally use,

index=* "x.x.x.x"

This is consuming more time. Is there any efficient query to overcome the delay.

[inventsekar]

most probably, the ip addresses are already captured and assigned to some fields.. for example.. sourceip, srcip, etc.. so just find out what field you are looking for(if you want to include two or more fields, then you can use OR option). then you can speed up the search like this.. this one will be much faster than the search you mentioned(because as it searches the already extracted fields)

index=* srcip="x.x.x.x"

 as said in the previous reply.. the datamodel, saved search are the best options.. 

or if you manually search, last 1 day logs with the ip address, then it may take around two/three or few mins.. 

instead, try to create a report, which runs every 6 hrs or so, when there is a match, it should email you the details. hope you got the idea. let us know if any further details required. thanks. 

[gcusello]

Hi @ashokoban,

if you want to search in the full row, this is the only choice.

If instead you want to search only in some fields, you could use a DataModel or schedule a search to save in a summary index only the fields to use in your search and then use the summary index for your search.

Ciao.

Giuseppe