1) What is the difference between using "| search ip=" and "ip="? They give the same outcome The idea that adding filter in index search improves performance is a general recommendation based ...
See more...
1) What is the difference between using "| search ip=" and "ip="? They give the same outcome The idea that adding filter in index search improves performance is a general recommendation based on the assumption that the bottleneck is number of raw events. This may not be the case. There could be another case where index search filter works better when field-based filter applies to index-time extracted fields. I did observe that in some of my searches index time filter slows search down rather than speeds it up. I have yet to conduct systematic research but if it doesn't speed up for you, use what works better. 2) Sorry about not mentioning dedup. Because dedup will remove any rows that have empty/null fields, so I put the dedup after join and adding "fillnull" command If I move it to each subsearch, I would need to add fillnull command for each subsearch and it's probably adding a delay. What do you think? dedup has an option keepemtpy that you can try | dedup keepempty=true ip, risk, score, contact In some of my use cases, keeping all events that has any empty field is a bit too much. In that case, you can do fillnull before dedup provided that you don't care to print those rows with empty risk, score, or contact. Something like | inputlookup host.csv
| rename ip_address as ip
| join max=0 type=left ip
[ search index=risk company IN (compA, compB)
| fields ip risk score contact
| fillnull risk score contact value=UNSPEC
| dedup ip risk score contact ]
| foreach risk score contact
[eval <<FIELD>> = if(<<FIELD>> == "UNSPEC", null(), <<FIELD>>)]
| table ip host risk score contact You can also apply the same technique with split subsearches. Again, I do not know your data characteristics. So, whether dedup does any good is for you to find out.