Splunk Search

Do we able to search string from different index which resides accross different client (Splunk forwarder) ?

sambed
Explorer

Let us think a scenario , where from different system having installed with Splunk forwarder connect to same SPLUNK server .So can we get the search option for a particular event (search string) which may occurs in in each different systems or client .

Tags (1)
0 Karma

sambed
Explorer

Thank You Cusello and Rich .
Your info is very helpful.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept an answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi sambed,
on Forwarders there aren't indexed logs, they are only in Splunk Enterprise.
So if you want only logs from a single Forwarder, you can run a search with the host value, something like this:

index=your_index host=your_forwarder

Bye.
Giuseppe

0 Karma

Richfez
SplunkTrust
SplunkTrust

Sure. Simplest:

index=* "My Search String"

Not necessarily recommended unless you have a good idea what you are doing because it'll search ALL data for that string - but it'll work fine enough.

Once you get results, you can use the Interesting Fields on the left to find out indexes and sourcetypes you need so that you can make the above search more specific (and thus faster). Like

index=Z OR index=X OR index=Y EventCode=4226 

Which would search in any of index X, Y or Z for a field named "EventCode" which is set to 4226.

I recommend taking a look at the search tutorial in Splunk docs. You may also want to check out the Basic Searching in Splunk free course.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...