Splunk Search

What is the most efficient way to filter search results by list?

AlexMcDuffMille
Communicator

Hello,

I am looking to filter my search results by the 'UniqueID' field so that I only get results from the devices that I want to monitor.

I believe there are two ways to do this:

  1. Search like this (make it an event type for easier reading): index=index1 (UniqueId=1 OR UniqueId=2 OR UniqueId=3 OR UniqueId=4)
  2. Create a lookup table and use input lookup.

Does anyone know if there is a 3rd option? Or if one is more efficient than the other?

Thanks!

Tags (4)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for tags: http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/Abouttagsandaliases

You'd define a tag monitoredDevice and configure your list of UniqueId values for that tag. Then you can search like this:

index=foo tag=monitoredDevice

Great to reuse in other searches and to be maintained in one location.

Under the hood Splunk will resolve that to the long list of OR'd values, giving you the best search performance.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You're probably looking for tags: http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/Abouttagsandaliases

You'd define a tag monitoredDevice and configure your list of UniqueId values for that tag. Then you can search like this:

index=foo tag=monitoredDevice

Great to reuse in other searches and to be maintained in one location.

Under the hood Splunk will resolve that to the long list of OR'd values, giving you the best search performance.

martin_mueller
SplunkTrust
SplunkTrust

Eventtypes would work here as well, but in my mind you're not actually defining a type of event but rather grouping a set of UniqueId values for any type of event they may produce. Performance would be the same.
Additionally, tags let you add/remove/edit values individually while an eventtype only lets you edit a massive string. Adding or removing UniqueId values should be much less error-prone with tags.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I don't think there is a better approach then these two. Best place for filter is in the main search pipeline. Among these two options, first one will be little faster(I guess) as no sub searches, but may will become complex to write/read as the no of UniqueIds will increase. I would go with option two as its configurable.

0 Karma

AlexMcDuffMille
Communicator

Correct. I have not yet implemented it, but I believe that is the general gist of how to do it.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

In your second option, you're talking about filtering entries at base search level only using inputlookup right?

Means like this--

index=index1 [|inputlookup uniqueIds.csv | table UniqueId] ...| rest of the search

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...