topic Another Newbee Question...Searching Indexed Data in Getting Data In

Another Newbee Question...Searching Indexed Data

Rayj00 — Wed, 23 Mar 2011 22:23:58 GMT

Totally new with Splunk. Have mercy on my soul! 🙂

I am trying to set up Splunk on my laptop as I am awaiting licensing issues to resolve for the Splunk Server we will be using.

I simply want to index and search my laptop (Window 7) event logs with Splunk, sort of a learning task for me. I am seeing about 25,000 event count in my_laptop index. On the search page I don't see any Fields listed. Actually nothing is listed. I did a "search=my_laptop" in the search field which I thought would list everything but I get nothing?

What am I missing?

Thanks,

Ray

Re: Another Newbee Question...Searching Indexed Data

ftk — Wed, 23 Mar 2011 22:39:28 GMT

By default the search app searches the main index only. Try the following search:

index=my_laptop

This will search for all events (implied *) in the my_laptop index.

Re: Another Newbee Question...Searching Indexed Data

Rayj00 — Thu, 24 Mar 2011 01:44:18 GMT

Thanks for that tip.