A city hunt for hosts that talked to C2 uses a subsearch that returns an entire day's destination IPs and then hits subsearch limits. What should the analyst do instead?
Select an answer to reveal the explanation.
Short Explanation
Subsearches have a small bucket — dump a whole day's dest IPs in and it overflows. For 'who talked to C2,' load the indicators as a lookup or join a tight tstats set, not a giant subsearch.
Full Explanation
Splunk subsearches are bounded by result count and runtime; returning an entire day's destination IPs commonly hits those limits and silently truncates. Intel-matching hunts should use a lookup of C2 indicators or a constrained tstats join rather than an oversized subsearch. Expanding to All Time or index=* makes the overflow worse. rex cannot raise the subsearch cap.