Splunk Dev

How to search and get error log or info log

inventor2014
New Member

if want to get error log only or info log only, how to search and get with JSON

i am not familiar with
var mySearch = "search * | head 5";

do not know whether data are in ascending or descending in date

is head 5 meaning that the latest 5 records

Tags (2)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Review this.

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Usethesearchcommand

But to answer more completely, events are returned in latest to earliest (most recent to farthest back) order by default, and head 5 indicates you only want the first 5 events returned.

Ayn
Legend

Sounds like you really need to take the basic Splunk tutorial.

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...