Splunk Search

How to search error messages in log file?

akothapx
Engager

Hi, I am new to Splunk. How to search error messages in the log file using SPL.
I am using the below formats to search for error messages.
source="sample_logcat.txt" host="debug" sourcetype="Android log" | head 20
source="sample_logcat.txt" host="debug" sourcetype="Android log" | tail 4
error* AND * | search iwlwifi
error* AND * | search Bluetooth

Is sub-search possible in Splunk? Can we search the result of a secondary or inner query as the input to the primary or outer question? 

If possible can anyone explain in detail?

Labels (2)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @akothapx,

answering to your questions:

Is sub-search possible in Splunk?

Yes, is possible, beware only to one thing: the field names in main and sub search must be the same (field names are case sensitive).

Can we search the result of a secondary or inner query as the input to the primary or outer question? 

yes, remember only that a sunsearch has the limit of 50,000 results.

In addition, it's ab est practice to put the search terms as left as possible, so it isn't a good idea to user a main search and after use the search command as you did:

source="sample_logcat.txt" host="debug" sourcetype="Android log" (iwlwifi OR Bluetooth)

if you haven't experience in SPL, follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial) to understand how SPL works.

In addition there are many interesting videos in the YouTube Splunk Channel: https://www.youtube.com/@Splunkofficial

Ciao.

Giuseppe

 

View solution in original post

0 Karma

akothapx
Engager

Thanks for the response @gcusello 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @akothapx ,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @akothapx,

answering to your questions:

Is sub-search possible in Splunk?

Yes, is possible, beware only to one thing: the field names in main and sub search must be the same (field names are case sensitive).

Can we search the result of a secondary or inner query as the input to the primary or outer question? 

yes, remember only that a sunsearch has the limit of 50,000 results.

In addition, it's ab est practice to put the search terms as left as possible, so it isn't a good idea to user a main search and after use the search command as you did:

source="sample_logcat.txt" host="debug" sourcetype="Android log" (iwlwifi OR Bluetooth)

if you haven't experience in SPL, follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial) to understand how SPL works.

In addition there are many interesting videos in the YouTube Splunk Channel: https://www.youtube.com/@Splunkofficial

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...