Splunk Streamlined search for specific fields only - field
I've ran out of GoogleFu, so if anyone can point me in the right direction or a better term or two to Google... I'm trying to figure out Splunk SPL syntax to search 4 different fields for the same value, any match in the four fields wins, with out searching every field for the TERM(<IP>).
index="main" packets_out>0 action="allowed" TERM(192.168.2.1)
| fields src_ip, dest_ip, dest_translated_ip, src_translated_ip,packets_out
| head 10
These will always be constant: index="main" packets_out>0 action="allowed"
The IP will be the only variable that will change and I'm trying to make it as simple as possible for others to "open search, change 1 IP, click go".
This works as is, but once I try to search against prod with 2000 devices.. I'm expecting my query time will not be 1 second anymore, even with using "Fast Mode" search. I've reduced the 4 second query time to 1. Along with the size of data queried with this already, in my home lab, but I don't think this is going to scale very well.
Is there a better way to do this, besides plugging in 10-20 device names into the query like this? I would rather not have static device names, so if someone "forgets" to update the query; I'll get blamed for the external IP overlap issue.
index="main" packets_out>0 action="allowed" TERM(192.168.2.1) dvc_name="firewall1" OR dvc_name="firewall2" <*18>
| fields src_ip, dest_ip, dest_translated_ip, src_translated_ip,packets_out
| head 10
Raw log if needed:
Apr 7 23:59:55 192.168.2.1 Apr 7 23:59:55 wall 1,2021/04/07 23:59:54,012801092758,TRAFFIC,end,2560,2021/04/07 23:59:54,192.168.2.189,173.194.219.94,10.10.10.2,173.194.219.94,web_access_out-1,,,quic,vsys1,trust,untrust,ethernet1/8,ethernet1/2,splunk,2021/04/07 23:59:54,2004,1,53384,443,59427,443,0x400050,udp,allow,5528,2350,3178,15,2021/04/07 23:57:53,1,any,0,5261883,0x0,192.168.0.0-192.168.255.255,United States,0,6,9,aged-out,0,0,0,0,,wall,from-policy,,,0,,0,,N/A,0,0,0,0,f863e426-7e87-4999-b5cb-bc6dc38d788f,0,0,,,,,,,,0.0.0.0,,,,,,,,,,,,,,,,,,,,,,,,,,,2021-04-07T23:59:55.282-04:00,,
Thanks,
Use OR:
index=ndx sourcetype=srctp (fieldA="myval" OR fieldB="myval" OR fieldC="myval")
Parenthesis added for clarity/readability
Related
How to find nodes being contained in a node's properties interval?
I'm currently developing some kind of a configurator using neo4j as a backend. Now I ran into a problem, I don't know how to solve best.
I've got nodes created like this:
(A:Product {name:'ProductA', minWidth:20, maxWidth:200, minHeight:10, maxHeight:400})
(B:Product {name:'ProductB', minWidth:40, maxWidth:100, minHeight:20, maxHeight:300})
...
There is an interface where the user can input a desired width & height, f.e. Width=30, Height=250. Now I'd like to check which products match the input criteria. As the input might be any long value, the approach used in http://neo4j.com/blog/modeling-a-multilevel-index-in-neoj4/ with dates doesn't seem to be suitable for me. How can I run a cypher query giving me all the nodes matching the input criteria?
I don't know if I understand well what you are asking for, but if I do, here a simple query to get this: Assuming the user wants width = 30 and height = 50 Match (p:Product) WHERE p.minWidth < 30 AND p.maxWidth > 30 AND p.minHeight < 50 AND p.maxHeight > 50 RETURN p If this is not what you are looking for, feel free to say it as comment.
Why is Neo4J telling me there is no spoon?
I am using Neo4J to represent texts; in the simplest case a text is a sequence of words joined by the relationship LEMMA_TEXT. I am trying to find the Nth word after a known word, with a query that looks something like this. MATCH (anchor)-[:LEMMA_TEXT*32]->(word) WHERE id(anchor) = 3275 RETURN word In one particular case, if I increase the path length to 33, I get this error: Neo.DatabaseError.Statement.ExecutionFailure: There is no spoon. And yet the following query returns the correct result. MATCH (anchor)-[:LEMMA_TEXT*32]->(word)-[:LEMMA_TEXT]->(next) WHERE id(anchor) = 3275 RETURN next which demonstrates that the node I want exists and is reachable. Where is the section of the manual that tells me how to bend the spoon with my mind? More importantly, what does this actually mean?!
If anything breaks at number like 33, it means that there was a restriction upto 32, why 32? 2^5. It's not trivial that most of the restrictions are in a factor of 2, MongoDB document size cannot be more than 16 MB, on a collection there could be maximum index, no more than 64. etc. why it works as 32 and then next, because till 32 it can achieve in one operation and for last one it can see the next one as another operation. But it cannot go for 33 in one operation. Most of these restrictions are basically sanity check though and not really technical boundary. As for why it is almost always a factor of 2, I want someone else to answer or in other words I don't know.
Have you tried splitting the landing and the search statements in 2? Plus you should add the label for the text word (forormance) Example: MATCH (anchor) WHERE id(anchor) = 3275 WITH anchor MATCH (anchor)-[:LEMMA_TEXT*32]->(word) RETURN word You get the same error?
neo4j REST 'Server got itself in trouble'
I am running a very basic test to check my understanding and evaluate neo4j REST server (neo4j-community-1.8.M07). I am using Neo4j Python REST Client. Each test iteration starts with a random strings for the source node name and the destination node name. The names contain only letters a..z and numbers 0..9 (oddly enough, I never got it to fail if I use A..Z and 0..9). The name may be from one char to 36 chars long and there are no repeating chars. I create 36 nodes, where the 1-st node name is only one char long and the 36-th node name has 36 chars. Then I create relations between all nodes. The name of each relation is the concatenation of the source node name and the destination node name. The final graph has 37 nodes (1 reference node and 36 nodes with names from one char to 36 non-repeating chars) and 1260 relations. Before each test iteration I clear the graph, so that it has only one (the reference) node. The problem is that after several successful iterations neo4j REST server crashes: Error [500]: Internal Server Error. Server got itself in trouble. Invalid data sent The query that crashes the system can be different - here is an example of a query_string that caused a problem: START n_from=node:index_faqts(node_name="h"), n_to=node:index_faqts(node_name="hg2b8wpj04ms")CREATE UNIQUE n_from-[r:`hhg2b8wpj04ms` ]->n_to RETURN r self.cypher_extension.execute_query( query_string ) I spent a lot of time trying to find a trend, but in vain. If I did something wrong with the queries none of the tests would ever work. I have observed crashes for number of successful test cycles between 5 and 25 rounds. What might be causing neo4j REST server to crash? P.S. Some details... The nodes are created like this: ... self.index_faqts[ "node_name" ][ p_str_node_name ] = self.gdb.nodes.create( **p_dict_node_attributes ) ... Just in case - before issuing the query to create a new relation I check the graph to make sure that the source and the destination nodes exist. That check never failed.
You are using too many relationship-types, currently the limit is at 32k. Might be patched in Neo4j if you have a valid use-case.
How to sort a list of 1million records by the first letter of the title
I have a table with 1 million+ records that contain names. I would like to be able to sort the list by the first letter in the name. .. ABCDEFGHIJKLMNOPQRSTUVWXYZ What is the most efficient way to setup the db table to allow for searching by the first character in the table.name field? The best idea right now is to add an extra field which stores the first character of the name as an observer, index that field and then sort by that field. Problem is it's no longer necessarily alphabetical. Any suggestions?
You said in a comment: so lets ignore the first letter part. How can I all records that start with A? All A's no B...z ? Thanks – AnApprentice Feb 21 at 15:30 I issume you meant How can I RETURN all records... This is the answer: select * from t where substr(name, 1, 1) = 'A'
I agree with the questions above as to why you would want to do this -- a regular index on the whole field is functionally equivalent. PostgreSQL (with some new ones in v. 9) has some rather powerful indexing capabilities for special cases which you might want to read about here http://www.postgresql.org/docs/9.1/interactive/sql-createindex.html
getting random rows with yql?
I want to use javascript to fetch data with yql from flickr, e.g. select id from flickr.photos.search(10) where text = 'music' and license=4 however, I would like to fetch 10 random rows, rather then the latest, since the latest tend to be 10 photos all from the same person. ist that possible in yql itself (I suspect not), or any workarounds that could bring the same effect? (it does not have to be complete random, the main thing I want to avoid is to get 10 photos from the same poster)
To get only results from unique owners, you can use the unique() function (docs). My suggestion would be to query for a larger result set (more likely to have 10 unique people) then call unique() followed by truncate() to limit to 10 results, as below. select id from flickr.photos.search(100) where text = 'music' and license=4 | unique(field="owner") | truncate(count=10)