Splunk Search

How can I see which directories the splunk query is searching through while its running?

EricLloyd79
Builder

Is there a way to view the directories that a Splunk Query is searching through as it hunts through events? I recall someone mentioning turning on DEBUG mode which I did but didnt see anything in the logs defining which directories were looked through.

Thanks

0 Karma

woodcock
Esteemed Legend

Why would you ever care?

0 Karma

MuS
Legend

Hi EricLloyd79,

yes and no, you can see the bucket ID but not the path. Try this run everywhere SPL which facilitates the Splunk internal field _cd ( that represents the bucket id and an address that provides the exact location of the event within its bucket) :

index=* earliest=-24h@h
| rex field=_cd "(?<bucketID>\d+)" 
| eval idx_bucketID=index .":". bucketID 
| stats count by idx_bucketID

This will give you a list of all buckets searched for each index, and since bucket ID's are uniq and are located in a known directory you can easily find them.

Hope this helps ...

cheers, MuS

UPDATE:
You could also use the _bkt field, but this will also not provide the full path. See more here http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usedefaultfields#_bkt

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...