Hello,
I am looking to filter my search results by the 'UniqueID' field so that I only get results from the devices that I want to monitor.
I believe there are two ways to do this:
index=index1 (UniqueId=1 OR UniqueId=2 OR UniqueId=3 OR UniqueId=4)
Does anyone know if there is a 3rd option? Or if one is more efficient than the other?
Thanks!
You're probably looking for tags: http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/Abouttagsandaliases
You'd define a tag monitoredDevice
and configure your list of UniqueId
values for that tag. Then you can search like this:
index=foo tag=monitoredDevice
Great to reuse in other searches and to be maintained in one location.
Under the hood Splunk will resolve that to the long list of OR
'd values, giving you the best search performance.
You're probably looking for tags: http://docs.splunk.com/Documentation/Splunk/6.1.2/Knowledge/Abouttagsandaliases
You'd define a tag monitoredDevice
and configure your list of UniqueId
values for that tag. Then you can search like this:
index=foo tag=monitoredDevice
Great to reuse in other searches and to be maintained in one location.
Under the hood Splunk will resolve that to the long list of OR
'd values, giving you the best search performance.
Eventtypes would work here as well, but in my mind you're not actually defining a type of event but rather grouping a set of UniqueId
values for any type of event they may produce. Performance would be the same.
Additionally, tags let you add/remove/edit values individually while an eventtype only lets you edit a massive string. Adding or removing UniqueId
values should be much less error-prone with tags.
I don't think there is a better approach then these two. Best place for filter is in the main search pipeline. Among these two options, first one will be little faster(I guess) as no sub searches, but may will become complex to write/read as the no of UniqueIds will increase. I would go with option two as its configurable.
Correct. I have not yet implemented it, but I believe that is the general gist of how to do it.
In your second option, you're talking about filtering entries at base search level only using inputlookup right?
Means like this--
index=index1 [|inputlookup uniqueIds.csv | table UniqueId] ...| rest of the search