https://community.splunk.com/t5/Splunk-Search/Search-by-file-name/m-p/81162#M20529 <P>As an admin that's used to searching logs with /bin/less, ? and /, I find the Splunk web interface pretty confusing. </P> <P>How can I limit searches in the web UI to specific source file names? In fact, I can't even see where Splunk even shows the name of the file that searches appeared in. This is really confusing. If I don't know what file a match was in, I really have no context of what I am seeing.</P> <P>Doug.</P> Sun, 31 Oct 2010 12:14:09 GMT dgarstang 2010-10-31T12:14:09Z https://community.splunk.com/t5/Splunk-Search/Search-by-file-name/m-p/81162#M20529 <P>As an admin that's used to searching logs with /bin/less, ? and /, I find the Splunk web interface pretty confusing. </P> <P>How can I limit searches in the web UI to specific source file names? In fact, I can't even see where Splunk even shows the name of the file that searches appeared in. This is really confusing. If I don't know what file a match was in, I really have no context of what I am seeing.</P> <P>Doug.</P> Sun, 31 Oct 2010 12:14:09 GMT https://community.splunk.com/t5/Splunk-Search/Search-by-file-name/m-p/81162#M20529 dgarstang 2010-10-31T12:14:09Z https://community.splunk.com/t5/Splunk-Search/Search-by-file-name/m-p/81163#M20530 <P>Hi Doug </P> <P>You can search for a specific file by specifying a file name for the <CODE>source</CODE> in the search field. In the example "spam" and "bytes" are the searchterms and the first part (source=/directory/file.log) limits the search to a source which is a file in this case</P> <P>If you select the source as a field using <CODE>"Pick fields"</CODE> every event ( this usually corresponds to one line in a logfile) will show it's source.</P> <P><IMG src="http://i51.tinypic.com/1432j6h.png" alt="alt text" /></P> <P>I hope this helps</P> <P>Chris</P> Sun, 31 Oct 2010 21:25:51 GMT https://community.splunk.com/t5/Splunk-Search/Search-by-file-name/m-p/81163#M20530 chris 2010-10-31T21:25:51Z