The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.
For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.
Application support engineers can pinpoint when a single server within a group of servers is generating errors, which can be critical to troubleshooting application issues.
Load data
How to implement: This example use case depends on application logs, application error logs, or both.
Ingest application logs from web servers, load balancers, application servers, and so on, and search for specific application errors or error codes. Use some basic searches to identify errors that originate from a specific server. You can display results in a dashboard, or just use the built-in features of the search window. For an elementary walk-through of how to use basic Splunk searches to find specific error codes, see the following video.
Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.
Get insights
Quickly identify which servers are impacted by a specific error.
Run the following search.
index=* ("*error*" OR "*fail*")
| top host limit=100
Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Help
If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.
For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.
For more support, post a question to the Splunk Answers community.
The Splunk Product Best Practices team helped produce this response. Read more about example use cases in the Splunk Platform Use Cases manual.
For more information on this and other examples, download the free Splunk Essentials for Infrastructure Troubleshooting and Monitoring app on Splunkbase.
Application support engineers can pinpoint when a single server within a group of servers is generating errors, which can be critical to troubleshooting application issues.
Load data
How to implement: This example use case depends on application logs, application error logs, or both.
Ingest application logs from web servers, load balancers, application servers, and so on, and search for specific application errors or error codes. Use some basic searches to identify errors that originate from a specific server. You can display results in a dashboard, or just use the built-in features of the search window. For an elementary walk-through of how to use basic Splunk searches to find specific error codes, see the following video.
Best practice: For all of the data inputs, specify a desired target index to provide a more sustainable practice for data access controls and retention models. By default, Splunk collects the data in the default index named main.
Get insights
Quickly identify which servers are impacted by a specific error.
Run the following search.
index=* ("*error*" OR "*fail*")
| top host limit=100
Best practice: In searches, replace the asterisk in index=* with the name of the index that contains the data. By default, Splunk stores data in the main index. Therefore, index=* becomes index=main. Use the OR operator to specify one or multiple indexes to search. For example, index=main OR index=security. See About managing indexes and How indexing works in Splunk docs for details.
Help
If no results appear, it may be because the add-ons were not deployed to the search heads, so the needed tags and fields are not defined. Deploy the add-ons to the search heads to access the needed tags and fields. See About installing Splunk add-ons in the Splunk Add-ons manual.
For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in the Splunk Add-ons manual.
For more support, post a question to the Splunk Answers community.
