Splunk Search

How to search error messages in log file?

akothapx
Engager

Hi, I am new to Splunk. How to search error messages in the log file using SPL.
I am using the below formats to search for error messages.
source="sample_logcat.txt" host="debug" sourcetype="Android log" | head 20
source="sample_logcat.txt" host="debug" sourcetype="Android log" | tail 4
error* AND * | search iwlwifi
error* AND * | search Bluetooth

Is sub-search possible in Splunk? Can we search the result of a secondary or inner query as the input to the primary or outer question? 

If possible can anyone explain in detail?

Labels (2)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @akothapx,

answering to your questions:

Is sub-search possible in Splunk?

Yes, is possible, beware only to one thing: the field names in main and sub search must be the same (field names are case sensitive).

Can we search the result of a secondary or inner query as the input to the primary or outer question? 

yes, remember only that a sunsearch has the limit of 50,000 results.

In addition, it's ab est practice to put the search terms as left as possible, so it isn't a good idea to user a main search and after use the search command as you did:

source="sample_logcat.txt" host="debug" sourcetype="Android log" (iwlwifi OR Bluetooth)

if you haven't experience in SPL, follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial) to understand how SPL works.

In addition there are many interesting videos in the YouTube Splunk Channel: https://www.youtube.com/@Splunkofficial

Ciao.

Giuseppe

 

View solution in original post

0 Karma

akothapx
Engager

Thanks for the response @gcusello 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @akothapx ,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @akothapx,

answering to your questions:

Is sub-search possible in Splunk?

Yes, is possible, beware only to one thing: the field names in main and sub search must be the same (field names are case sensitive).

Can we search the result of a secondary or inner query as the input to the primary or outer question? 

yes, remember only that a sunsearch has the limit of 50,000 results.

In addition, it's ab est practice to put the search terms as left as possible, so it isn't a good idea to user a main search and after use the search command as you did:

source="sample_logcat.txt" host="debug" sourcetype="Android log" (iwlwifi OR Bluetooth)

if you haven't experience in SPL, follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial) to understand how SPL works.

In addition there are many interesting videos in the YouTube Splunk Channel: https://www.youtube.com/@Splunkofficial

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...