Need a help in writing a query in splunk

[jagan_vannala]

I need a help for writing a query to fetch logs in the system

[gcusello]

Hi @jagan_vannala ,

as also @marnall  said, your question is too vague: which kind of logs are you speaking of?

did you already ingested or do you have to index them?

i you already indexed them, you must know index and sourcetype of them.

If you have to index them, see at https://docs.splunk.com/Documentation/SplunkCloud/8.1.10/Data/Getstartedwithgettingdatain the ways to ingest and to index logs.

Ciao.

Giuseppe

[marnall]

What kind of logs are you trying to fetch? Does the system have a forwarder or Splunk Enterprise installed on it?

[jagan_vannala]

System having a splunk forwarder