topic Re: Do we able to search string from different index which resides accross different client (Splunk forwarder) ? in Splunk Search

Do we able to search string from different index which resides accross different client (Splunk forwarder) ?

sambed — Tue, 20 Jun 2017 07:59:07 GMT

Let us think a scenario , where from different system having installed with Splunk forwarder connect to same SPLUNK server .So can we get the search option for a particular event (search string) which may occurs in in each different systems or client .

Re: Do we able to search string from different index which resides accross different client (Splunk forwarder) ?

Richfez — Tue, 20 Jun 2017 11:44:30 GMT

Sure. Simplest:

index=* "My Search String"

Not necessarily recommended unless you have a good idea what you are doing because it'll search ALL data for that string - but it'll work fine enough.

Once you get results, you can use the Interesting Fields on the left to find out indexes and sourcetypes you need so that you can make the above search more specific (and thus faster). Like

index=Z OR index=X OR index=Y EventCode=4226

Which would search in any of index X, Y or Z for a field named "EventCode" which is set to 4226.

I recommend taking a look at the search tutorial in Splunk docs. You may also want to check out the Basic Searching in Splunk free course.

Re: Do we able to search string from different index which resides accross different client (Splunk forwarder) ?

gcusello — Tue, 20 Jun 2017 11:45:27 GMT

Hi sambed,
on Forwarders there aren't indexed logs, they are only in Splunk Enterprise.
So if you want only logs from a single Forwarder, you can run a search with the host value, something like this:

index=your_index host=your_forwarder

Bye.
Giuseppe

Re: Do we able to search string from different index which resides accross different client (Splunk forwarder) ?

sambed — Fri, 23 Jun 2017 07:43:40 GMT

Thank You Cusello and Rich .
Your info is very helpful.

Re: Do we able to search string from different index which resides accross different client (Splunk forwarder) ?

richgalloway — Fri, 23 Jun 2017 11:57:11 GMT

If your problem is resolved, please accept an answer.