Splunk Search

Do we able to search string from different index which resides accross different client (Splunk forwarder) ?

sambed
Explorer

Let us think a scenario , where from different system having installed with Splunk forwarder connect to same SPLUNK server .So can we get the search option for a particular event (search string) which may occurs in in each different systems or client .

Tags (1)
0 Karma

sambed
Explorer

Thank You Cusello and Rich .
Your info is very helpful.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept an answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi sambed,
on Forwarders there aren't indexed logs, they are only in Splunk Enterprise.
So if you want only logs from a single Forwarder, you can run a search with the host value, something like this:

index=your_index host=your_forwarder

Bye.
Giuseppe

0 Karma

Richfez
SplunkTrust
SplunkTrust

Sure. Simplest:

index=* "My Search String"

Not necessarily recommended unless you have a good idea what you are doing because it'll search ALL data for that string - but it'll work fine enough.

Once you get results, you can use the Interesting Fields on the left to find out indexes and sourcetypes you need so that you can make the above search more specific (and thus faster). Like

index=Z OR index=X OR index=Y EventCode=4226 

Which would search in any of index X, Y or Z for a field named "EventCode" which is set to 4226.

I recommend taking a look at the search tutorial in Splunk docs. You may also want to check out the Basic Searching in Splunk free course.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...