Splunk Search

How to access the raw data collected by Splunk?

sc2019
New Member
  1. I want to access the log files from Web servers, Micro Services, by protocol (HTTP, SOAP, FTP, etc.) or Databases.

  2. What are the aggregates which Splunk avails to user via the Splunk interface? (We know about volumes and response time but would like to know other protocols like return codes, etc.)

Tags (1)
0 Karma

solarboyz1
Builder

Splunk takes the raw data an indexes it, you can then run searches against the data.

You can access the data by running searches in Splunk, which can be done via the REST API:
https://dev.splunk.com/restapi

The following is a list of the aggregate functions that can be used:
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Stats

Via rest, you could run a basic search like "index=*" , which would return the raw events.

You use the stats functions against fields in the data, "index=* | stats sum(kb) as "kb sent" by host"

What aggregates you can calculate will depend on the data you have, and what fields are available.

Splunk has several add-on available for parsing and reporting on data from common tools, systems, etc..

0 Karma

somesoni2
Revered Legend

I suggest you start from here:(Splunk Search Tutorial) https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Startsearching.

If you still have question about specific query/report that want to generate, then provide little more detailed requirement, sample data and expected output.

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...