Make Paloalto search faster

[lubanamanjinder]

Hi There I am new to splunk and trying to figure out a way to make the below search faster : 

index=pan_logs sourcetype="pan:threat" | search NOT (client_ip=xxxx OR client=xxxx OR client_ip=xxxx OR client_ip=xxxx OR client_ip=xxxx OR client_ip=xxxx ) | eval field=split(_raw, ",") | eval type=mvindex(field,3), subtype=mvindex(field,4), src_ip=mvindex(field,7), dst_ip=mvindex(field,8), nat_src=mvindex(field,9), nat_dst=mvindex(field,10), rule_name=mvindex (field,11), app=mvindex(field,14),src_zone=mvindex(field,16),dst_zone=mvindex(field,17), ingress_if=mvindex(field,18), egress_if=mvIndex(field,19), log_action=mvindex(field ,20), src_port=mvindex(field,24), dst_port=mvindex(field,25), proto=mvindex(field,29), action=mvindex(field,30), url=mvindex(field,31), threat_id=mvindex(field,32), cat =mvindex(field,33), sev=mvindex(field,34), direction=mvindex(field,45) | search subtype!=url action=allowed OR action=alert OR action=sinkhole url!="\"saw.dll\"" | table _time type subtype src_ip dst_ip nat_src nat_dst rule_name app src_zone dst_zone ingress_if egress_if log_action src_port dst_port proto action url threat_id cat sev direction index | fields "_time", "action", "app", "cat", "direction", "dst_ip", "dst_port", "dst_zone", "egress_if", "index", "ingress_if", "log_action", "nat_dst", "nat_src", "proto", "rule_name", "sev", "src_ip", "src_port", "src_zone", "subtype", "threat_id", "type", "url"

Thank you so much in advance .

[scelikok]

Hi @lubanamanjinder,

It seems "Palo Alto Networks Add-on for Splunk" is not installed on your Search Head. Otherwise the fields that you create using split and eval already be extracted.

After installing below app on your search head, below search should work much faster.

https://splunkbase.splunk.com/app/2757/#/details 

index=pan_logs sourcetype="pan:threat" NOT (client_ip=xxxx OR client=xxxx OR client_ip=xxxx OR client_ip=xxxx OR client_ip=xxxx OR client_ip=xxxx ) subtype!=url action=allowed OR action=alert OR action=sinkhole url!="\"saw.dll\"" 
| table _time, action, app, cat, direction, dst_ip, dst_port, dst_zone, egress_if, index, ingress_if, log_action, nat_dst, nat_src, proto, rule_name, sev, src_ip, src_port, src_zone, subtype, threat_id, type, url