I need to search whether a set of ips (say 15 to 20 ips) are present in all the events (no specific index,source,sourcetype) for the past 7 days.
index=* "a.b.c.d" OR "d.e.f.g" OR "d.s.d.d" ....
Then I extract a multivalue field to extract the ip wherever present in the event.
index=* universalip="a.b.c.d" OR "d.e.f.g" OR "d.s.d.d" ....
It consumes much time. Is there any way to optimize the query?
Thanks in advance.
Hi splunkn,
any search containing either specific index
,source
or sourcetype
will be faster; take a look at this great answer here http://answers.splunk.com/answers/172275/how-do-optimizations-for-field-based-searches-work.html
Also, search like this might be a bit faster:
index=* universalip="a.b.c.d" OR universalip="d.e.f.g" OR universalip="d.s.d.d"
But still, try to use any specific index
or source
or sourcetype
in your base search and it will be much faster.
cheers, MuS
Hi splunkn,
any search containing either specific index
,source
or sourcetype
will be faster; take a look at this great answer here http://answers.splunk.com/answers/172275/how-do-optimizations-for-field-based-searches-work.html
Also, search like this might be a bit faster:
index=* universalip="a.b.c.d" OR universalip="d.e.f.g" OR universalip="d.s.d.d"
But still, try to use any specific index
or source
or sourcetype
in your base search and it will be much faster.
cheers, MuS
Thanks MuS, anyway I want to search the whole data what I received. So I am not able to specify particular index/source/sourcetype here. Is there any other option?
One possible way to speed it up, you can limit / specify the indexes which are search by default for the users role http://docs.splunk.com/Documentation/Splunk/6.2.1/Security/Addandeditroles but then on the other hand, you're not searching the whole data.....