Splunk Search
Highlighted

How can I see which directories the splunk query is searching through while its running?

Builder

Is there a way to view the directories that a Splunk Query is searching through as it hunts through events? I recall someone mentioning turning on DEBUG mode which I did but didnt see anything in the logs defining which directories were looked through.

Thanks

0 Karma
Highlighted

Re: How can I see which directories the splunk query is searching through while its running?

SplunkTrust
SplunkTrust

Hi EricLloyd79,

yes and no, you can see the bucket ID but not the path. Try this run everywhere SPL which facilitates the Splunk internal field _cd ( that represents the bucket id and an address that provides the exact location of the event within its bucket) :

index=* earliest=-24h@h
| rex field=_cd "(?<bucketID>\d+)" 
| eval idx_bucketID=index .":". bucketID 
| stats count by idx_bucketID

This will give you a list of all buckets searched for each index, and since bucket ID's are uniq and are located in a known directory you can easily find them.

Hope this helps ...

cheers, MuS

UPDATE:
You could also use the _bkt field, but this will also not provide the full path. See more here http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields#_bkt

0 Karma
Highlighted

Re: How can I see which directories the splunk query is searching through while its running?

Esteemed Legend

Why would you ever care?

0 Karma