Splunk Search

Can't search

wiz561
Explorer

I am just getting started with Splunk at home on Ubuntu. I'm gathering logs from my pfsense firewall and I can see that there are indexed events. When trying to search for something, the search box gets disabled and a little "do not enter" or "no" sign shows up where the cursor is. No results are returned.

I'm just typing in host="10.0.110.1" in the search field.

I'm assuming that there isn't something running that needs to be. I did switch the license from enterprise trial to the free 500meg/day license.

Tags (2)
0 Karma

amiracle
Splunk Employee
Splunk Employee

Did you add the os index and any other custom index to the Search Index by default. In the Web UI (Settings -> Access Controls -> Roles -> Admin -> scroll down to 'Indexes searched by default' and add the indexes you want to search by default. I hope that helps.

0 Karma

woodcock
Esteemed Legend

See what Splunk is complaining about with this search:

index=_internal source=*splunkd.log* log_level!=info | cluster showcount=t | table cluster_count _raw | sort -cluster_count
0 Karma

wiz561
Explorer

Thanks for the response. I think the problem lies deeper than this. I installed the *nix app and can sucessfully gather information from the local box. Even though Splunk says it is receiving information, I don't think it's making it searchable for some reason.

0 Karma

woodcock
Esteemed Legend

You (probably) need to specify an index; try this:

index=* OR index=_* host="10.0.110.1"
0 Karma
Get Updates on the Splunk Community!

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...