Once we get data into Splunk, what are basic searches we need to run for testing?

[luckymaddy]

Hi,

Once we get data into splunk, what is the basic testing we have to do?
What are the basic searches we need to run?

[stephane_cyrill]

Hi, once data get into splunk:

1-in search and reporting, when you click on SUMMARY INDEX, you have your new source and/or sourtype populated there.You can click on it to launch a search to see your events an your fields.

2- Immediately after adding data,splunk proposes you to start search on that.

3- if you know the index OR the source Or the sourcetype where you put your data, to see your eventdata your can type in search:
index=…… OR source=… OR sourcetype=…

4- if you don't know all the previous, you can type only * in search an you will see all eventdata ,all fields from all indexes and sources.

docs.splunk.com/Documentation/Splunk/6.2.2/Search/Whatsinthismanual

[ppablo]

Hi @luckymaddy

What exactly are you trying to test? Are you trying to see if your indexed data is searchable?

[luckymaddy]

In Splunk app for Enterprise security what are the basic search commands we can run to test the security of the applications/servers that are integrated to Splunk?