{"id":37742,"date":"2021-06-07T21:03:16","date_gmt":"2021-06-07T21:03:16","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=37742"},"modified":"2021-06-07T21:03:16","modified_gmt":"2021-06-07T21:03:16","slug":"answer-by-warren-for-subsearch-produced-221180-results-truncating-to-maxout-10000","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=37742","title":{"rendered":"Answer by warren for Subsearch produced 221180 results, truncating to maxout 10000"},"content":{"rendered":"<p>You&#8217;re close<\/p>\n<p>Do this instead:<\/p>\n<pre><code>index=*_abc [| inputlookup deattackerv1.csv | rename ip as src_ip] \n| stats count by src_ip,index\n<\/code><\/pre>\n<p>This will use the <a href=\"https:\/\/docs.splunk.com\/Documentation\/Splunk\/latest\/SearchReference\/inputlookup\" rel=\"nofollow noreferrer\"><code>inputlookup<\/code><\/a> the way you want it to (ie, only match IPs that are in it)<\/p>\n<p>from User warren &#8211; Stack Overflow https:\/\/stackoverflow.com\/questions\/67874897\/subsearch-produced-221180-results-truncating-to-maxout-10000\/67878662#67878662<br \/>\nvia <a href=\"https:\/\/ifttt.com\/?ref=da&#038;site=wordpress\">IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>You&#8217;re close Do this instead: index=*_abc [| inputlookup deattackerv1.csv | rename ip as src_ip] | stats count by src_ip,index This will use the inputlookup the way you want it to (ie, only match IPs that are in it) from User warren &#8211; Stack Overflow https:\/\/stackoverflow.com\/questions\/67874897\/subsearch-produced-221180-results-truncating-to-maxout-10000\/67878662#67878662 via IFTTT<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-37742","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/37742","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=37742"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/37742\/revisions"}],"predecessor-version":[{"id":37743,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/37742\/revisions\/37743"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=37742"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=37742"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=37742"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=37742"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}