Splunk Enterprise

walklex: what is it telling me?

charlesmeo
Explorer

Given this search:

| walklex index=web prefix=host

what is the value contained in 'source'?

source = web~22~F3E2588C-834C-4B2A-B12B-3845A69B5304

I thought this might be a bucket id but it doesn't seem to be. First bit is the index name--what's the rest of it?

walklex documentation doesn't explain what is actually returned by this command, or how to use it.

Charles

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @charlesmeo,

It is the bucket name, a string composed of <index>~<id>~<guId>, where the delimiters are tilde characters. 

index = index name

id = bucket local id number

guid = guid of the indexer that host that index

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

charlesmeo
Explorer

Thanks @scelikok answer accepted. Still leaves the larger issue--documentation in this area (walklex, lispy) is pretty sketchy or non-existent.

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @charlesmeo,

It is the bucket name, a string composed of <index>~<id>~<guId>, where the delimiters are tilde characters. 

index = index name

id = bucket local id number

guid = guid of the indexer that host that index

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...