Splunk Dev

How to search and get error log or info log

inventor2014
New Member

if want to get error log only or info log only, how to search and get with JSON

i am not familiar with
var mySearch = "search * | head 5";

do not know whether data are in ascending or descending in date

is head 5 meaning that the latest 5 records

Tags (2)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Review this.

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Usethesearchcommand

But to answer more completely, events are returned in latest to earliest (most recent to farthest back) order by default, and head 5 indicates you only want the first 5 events returned.

Ayn
Legend

Sounds like you really need to take the basic Splunk tutorial.

Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...