Hello   I'm looking to run a search in a Firewall log index for connections to a know IP range and trying to decide which is the more efficient way of doing it. As can be seen I'm excluding certain ports we expect to see traffic on I seem to remember that using "!=" is also considered inefficient as well open to other suggestions for using something else. Current search looks like this index="pan_logs" sourcetype="pan:traffic" dest_ip="91.226.*.*" | lookup dnslookup clientip AS src_ip OUTPUT clienthost AS remotehost | search dest_port!=48600 dest_port!=22 | table _time dest_ip dest_port remotehost ... View more

Hi New to the idea of connectting Splunk to my databases. I have installed DB Connect v2 on my Splunk Enterprise and got a working connection to the database I want to get the information from. I have got the query right and I'm getting results that show the size of the log and mdb files on disk along with info like file path etc. I'm happy with what I can see. However I have no idea how to approach the next step i.e. Choose the splunk fiels to base the search on. I just don't understand what I'm supposed to put in here. I,ve read the documentation and if I do a simple search like index=* I get loads of fields to choose from but not sure which to select or why!!! Any ideas or am I doing this the wrong way completely. All I want to do is create a scheduled report from the lookup to be able to emain it to the DBA. Andy ... View more