Searching the data

[santosh_sshanbh]

How to see the indexed event wrt this input. I have configured a input to monitor one log file. But I dont see any dashboard which comes with this app. Then how can I see the events. Please provide me the SPL.

[sudosplunk]

If you know the index name you configured for the data to land, then try searching with that index. Else, use index=* and try searching with log file name in source field.

index=<your_index> source=/path/to/file/log_file_name OR index=* source=/path/to/file/log_file_name.

Note: For the first time, run these searches for All Time, just to see you have data.

Also, go through Splunk search tutorial for more details and explanation

Happy Splunking!