topic Re: Searching for data from different log files with similar field names in Splunk Search

Searching for data from different log files with similar field names

william_choo — Wed, 02 Jun 2021 03:53:17 GMT

Hi,

I'm new to Splunk here...

I have a local instance of Splunk Enterprise on my local machine where I've created a data input via Data Input > Files & Directories, and then created an Index which I then map the data input to.

Within this folder, I've dumped various types of log files from different formats / types of web servers e.g. Apache webserver and IIS , even JSON-formatted log files for analysis.

When I do search for a field name that exists in log files from different formats, does the search results come out for both? Is there any link/doc that explains the best practices or how Splunk behaves with regards to how data is indexed in this circumstance?

Thanks in advance.

Re: Searching for data from different log files with similar field names

bowesmana — Wed, 02 Jun 2021 04:56:14 GMT

Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.

Yes, if you search

index=* field=x

then it will find all data from the indexes where the events have a field called 'field' with the value x

I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain

Re: Searching for data from different log files with similar field names

william_choo — Wed, 02 Jun 2021 06:39:23 GMT

Hello @bowesmana

Thank you for the advice! Yes I've actually been doing quite a bit of 'unstructured' learning, hopping here and there and also viewing youtube tutorials... I guess I was speeding thru the search fundamentals and missed out some essentials. I was able to create my own Splunk app to ingest some logs but realized I didn't fully understand some of the basics which were crucial for analysis.

Thanks once again for the links!