topic Re: Raw Logs in Splunk Search

Raw Logs

rahul2gupta — Thu, 24 Sep 2020 03:43:58 GMT

Hi ,

How do I fetch the raw logs for the source type :wms_oracle_sessions?

Query:

Thank you very much.

Regards,

Rahul

Re: Raw Logs

ITWhisperer — Thu, 24 Sep 2020 07:10:36 GMT

index=main sourcetype=wms_oracle_sessions

gives you the raw logs.

If you want to see the raw logs from the stats in your query, run it in verbose mode and look at the events

Re: Raw Logs

rahul2gupta — Thu, 24 Sep 2020 07:23:19 GMT

Hi @ITWhisperer ,

When I run the query,I see No Results found .

Does that mean there is no raw logs?

Regards,

Rahul

Re: Raw Logs

ITWhisperer — Thu, 24 Sep 2020 07:26:32 GMT

Correct - as it suggests, try a different time period

Re: Raw Logs

rahul2gupta — Mon, 28 Sep 2020 03:40:06 GMT

Hi @ITWhisperer ,

The sourcetype=wms_oracle_sessions take the inputs from two oracle servers Ind1ora01 & Indora02.

Can we some how find , which logs it is taking as a Input.

Regards,

Rahul

Re: Raw Logs

ITWhisperer — Mon, 28 Sep 2020 06:31:33 GMT

I assume you have forwarders on the oracle servers which as configured to harvest logs and send them to the indexers in splunk. You need to look at the configuration of those to find out which paths they are using to find logs to send.