Analyzing logs

[eparmeza]

Hi Guys,
I was hoping you can help me.
I am using Splunk to analyze some logs that I got from a company, but I don't know how to interpret them. The files I am trying to analyze are XML, JMX, .log format. The logs contain real time information about servers of the company. For example, I would like to know how can I find errors in these logs. Another thing I can't explain is that why some logs have one event, while some others have more.
Thank you in advance!

[gcusello]

Hi @eparmeza,

let me understand: did you already  ingested logs or you have to ingest them?

if you have to ingest them, it's too long to describe here, start reading:

• how to ingest logs: https://docs.splunk.com/Documentation/Splunk/8.0.5/Data/WhatSplunkcanmonitor
• how to search them: https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchTutorial/WelcometotheSearchTutorial

if you already have them, the main problem is to know what to search: usually 70% of the job is to know what to do and 30% is to do it in Splunk.

In other words, you have to know the technology you're searching, so e.g. if you have to search the Oracle Errors, you have to know the Oracle errors are coded as ORA-xxx.

When you have in mind what to search, you can search logs as free text (Google like) or using extracted fields (as a DB).

In the first case:

index=oracle_logs ORA-12234

in the second case:

index=oracle_logs error=ORA-1234

To do this read the above Search Tutorial.

Ciao.

Giuseppe