Splunk Search

How to search error messages in log file?

akothapx
Engager

Hi, I am new to Splunk. How to search error messages in the log file using SPL.
I am using the below formats to search for error messages.
source="sample_logcat.txt" host="debug" sourcetype="Android log" | head 20
source="sample_logcat.txt" host="debug" sourcetype="Android log" | tail 4
error* AND * | search iwlwifi
error* AND * | search Bluetooth

Is sub-search possible in Splunk? Can we search the result of a secondary or inner query as the input to the primary or outer question? 

If possible can anyone explain in detail?

Labels (2)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @akothapx,

answering to your questions:

Is sub-search possible in Splunk?

Yes, is possible, beware only to one thing: the field names in main and sub search must be the same (field names are case sensitive).

Can we search the result of a secondary or inner query as the input to the primary or outer question? 

yes, remember only that a sunsearch has the limit of 50,000 results.

In addition, it's ab est practice to put the search terms as left as possible, so it isn't a good idea to user a main search and after use the search command as you did:

source="sample_logcat.txt" host="debug" sourcetype="Android log" (iwlwifi OR Bluetooth)

if you haven't experience in SPL, follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial) to understand how SPL works.

In addition there are many interesting videos in the YouTube Splunk Channel: https://www.youtube.com/@Splunkofficial

Ciao.

Giuseppe

 

View solution in original post

0 Karma

akothapx
Engager

Thanks for the response @gcusello 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @akothapx ,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @akothapx,

answering to your questions:

Is sub-search possible in Splunk?

Yes, is possible, beware only to one thing: the field names in main and sub search must be the same (field names are case sensitive).

Can we search the result of a secondary or inner query as the input to the primary or outer question? 

yes, remember only that a sunsearch has the limit of 50,000 results.

In addition, it's ab est practice to put the search terms as left as possible, so it isn't a good idea to user a main search and after use the search command as you did:

source="sample_logcat.txt" host="debug" sourcetype="Android log" (iwlwifi OR Bluetooth)

if you haven't experience in SPL, follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial) to understand how SPL works.

In addition there are many interesting videos in the YouTube Splunk Channel: https://www.youtube.com/@Splunkofficial

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...