topic Re: Splunk Fundamentals Module 5 in Splunk Search

Splunk Fundamentals Module 5

avergar5 — Wed, 07 Jul 2021 12:51:18 GMT

Hi, I am testing out Splunk Fundamentals 1, and on Module 5 of the lab portion, after running the search, I am not getting any events.

I have tried in both admin, and user roles, and have tested the presets for all time, previous year, previous month, etc.

Re: Splunk Fundamentals Module 5

Funderburg78 — Wed, 07 Jul 2021 13:14:08 GMT

since I do not have the lab guide, maybe if you post the query you typed in we can see if there is a mistake.

Re: Splunk Fundamentals Module 5

avergar5 — Wed, 07 Jul 2021 13:54:22 GMT

I successfully uploaded this data, but I cannot even get results when I search:

sourcetype=linux_secure

Re: Splunk Fundamentals Module 5

Funderburg78 — Wed, 07 Jul 2021 13:57:44 GMT

try typing: index=* sourcetype=linux_secure

I think your problem is splunk often wants an index unless you have default index lookups configured in splunk which seeing you are in fundamentals 1, you probably do not. ig that does not work, try just typeing: index!=_*

This should return any data in any index except for splunk specific logs data. This will tell you for sure you have some data or not. Also, then see if in the interesting columns under sourcetype, you see the sourcetype you are looking for.

Re: Splunk Fundamentals Module 5

Floyd22 — Wed, 07 Jul 2021 14:53:34 GMT

I was reading your reply and I have the same problem in Splunk Fundamental Lab 5. In the instruction we are instructed to use the "fail*AND password" command over ALL TIME. I got no results. I used your "index!=_*" command got goo d results. But what does that do? The "fail* AND password" still doe not return anything. Your help is greatly appreciated.

Re: Splunk Fundamentals Module 5

Funderburg78 — Wed, 07 Jul 2021 18:01:54 GMT

index!=_* returns all data from all indexes except the Splunk system indexes. Now that you know you have data, try:

index!=_* "fail*" AND "password"