I have not run into any restrictions. Are you asking about lookup tables that you'll use as lookups (using the lookup search command) or lookup tables that you'll use as search filters (using the inputlookup search command)? The first is likely to slow things down if you are running a lot of chained lookups, and the latter is possible to grow your search results to an unmanageable size, depending on the size of the lookup file. ... View more

Can you tell us more about what you mean by "false alert is coming that is the issue due to slowness"? Are you saying your search takes so long to return that it times out, giving the false impression that there were no results? If so, maybe a solution would be to tune the query to ensure it never times out. Based on your comments above, it seems like you're running this query: index=index_days sourcetype=sourcetype_name "search sring" | stats count And you want it to alert if there are 0 results returned, right? But you are getting alerts for times when you think it should have found results? If so, maybe try this: index=index_days sourcetype=sourcetype_name "search sring" | head 1 That way, if there's a single result, it will find the first one and return immediately. That could help with a timeout. ... View more

First step will be to take the data in your lookup and make sure you've defined it as a wildcard lookup. You can do that by creating a Lookup in the Splunk Web UI, specifying the csv as the Lookup file and then putting this into the field Match type: WILDCARD(Address), WILDCARD(UserName), WILDCARD(Email), WILDCARD(Message) . Let's say you called the lookup get_type , so that I can refer to it below. Next, you'll use that lookup in your search. You'll do that like this: your base search that gives you the first table above | lookup get_type Address, UserName, Email, Message OUTPUT Type Then you'll fill in the Type field for events that had no matches: | fillnull value="Other" Type ... View more

I'd approach this one of two ways: Determine a cutoff for what it means to have "high total volumes of work" - that could be 10 orders or 100 orders; it's all contextual, based on your business. But choose a number. Let's say you choose 100. Then I'd collect all events relating to orders and failures, count how many orders were placed per vendor using something like |eventstats count(eval(order_placed=1)) AS order_count by vendor , and then filter down to vendors with >100 orders by | where order_count>100 . Then I'd use a stats call to count the failures by vendor and finally use top to order them by failure_count: top 10 failure_count . If it's not possible to define a priori what it means to have "high total volumes of work", then I would do something similar to order the vendors by order_count, but instead of filtering by order_count>100 , I'd do some analysis to retain only the top 15% or 25% of vendors by order_count and then use the same analysis as above to get to the top 10 by failure_count. If you'd like help actually implementing the syntax for either of these, I'd be happy to help. Just provide some examples of events that characterize orders and events that characterize failures. ... View more

I notice that your sample dates have dashes, while your attempted regex uses slashes. How about this: index=_internal | eval Mahesh=replace(date, "^(\d{1,2})-(\d{1,2})-", "\2/-1-") ... View more

This should run more efficiently by avoiding the join command and duplicate searching: index=customindex sourcetype=custom src | iplocation allfields=true lang=code HOST | eval us_host=if(Country="US", HOST, NULL), non_us_host=if(Country!="US", HOST, NULL) | stats estdc(us_host) AS total_us, estdc(non_us_host) AS total_non_us BY USERID | fillnull | eval total = total_non_us + total_us ... View more