I'm running a search across a bunch of data, say web logs, that has a lot of different src_ip
s.
I make a lookup of a handful of src_ip
s that I want to take a look at:
lookup table [iptable]
src_ip
1.2.3.4
1.2.3.5
1.2.4.6
What is the best way to search across all of my data (sourcetype=web, for instance) and ONLY show items matching my lookup file?
Assuming there is a field in your data called src_ip
, and that you have (say) millions of events and less than a few hundred entries in your lookup table, the most efficient way is probably:
sourcetype=web [ inputlookup iptable | fields src_ip ]
If the field in the sourcetype is called, say, source_address
, you could do:
sourcetype=web [ inputlookup iptable | fields src_ip | rename src_ip as souce_address ]
Assuming there is a field in your data called src_ip
, and that you have (say) millions of events and less than a few hundred entries in your lookup table, the most efficient way is probably:
sourcetype=web [ inputlookup iptable | fields src_ip ]
If the field in the sourcetype is called, say, source_address
, you could do:
sourcetype=web [ inputlookup iptable | fields src_ip | rename src_ip as souce_address ]
sourcetype=web | join src_ip [inputlookup iptable]
?