most probably, the ip addresses are already captured and assigned to some fields.. for example.. sourceip, srcip, etc.. so just find out what field you are looking for(if you want to include two or more fields, then you can use OR option). then you can speed up the search like this.. this one will be much faster than the search you mentioned(because as it searches the already extracted fields) index=* srcip="x.x.x.x" as said in the previous reply.. the datamodel, saved search are the best options.. or if you manually search, last 1 day logs with the ip address, then it may take around two/three or few mins.. instead, try to create a report, which runs every 6 hrs or so, when there is a match, it should email you the details. hope you got the idea. let us know if any further details required. thanks.
... View more