Splunk Enterprise

walklex: what is it telling me?

charlesmeo
Explorer

Given this search:

| walklex index=web prefix=host

what is the value contained in 'source'?

source = web~22~F3E2588C-834C-4B2A-B12B-3845A69B5304

I thought this might be a bucket id but it doesn't seem to be. First bit is the index name--what's the rest of it?

walklex documentation doesn't explain what is actually returned by this command, or how to use it.

Charles

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @charlesmeo,

It is the bucket name, a string composed of <index>~<id>~<guId>, where the delimiters are tilde characters. 

index = index name

id = bucket local id number

guid = guid of the indexer that host that index

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

charlesmeo
Explorer

Thanks @scelikok answer accepted. Still leaves the larger issue--documentation in this area (walklex, lispy) is pretty sketchy or non-existent.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @charlesmeo,

It is the bucket name, a string composed of <index>~<id>~<guId>, where the delimiters are tilde characters. 

index = index name

id = bucket local id number

guid = guid of the indexer that host that index

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...