Hi,
Once we get data into splunk, what is the basic testing we have to do?
What are the basic searches we need to run?
Hi, once data get into splunk:
1-in search and reporting, when you click on SUMMARY INDEX, you have your new source and/or sourtype populated there.You can click on it to launch a search to see your events an your fields.
2- Immediately after adding data,splunk proposes you to start search on that.
3- if you know the index OR the source Or the sourcetype where you put your data, to see your eventdata your can type in search:
index=…… OR source=… OR sourcetype=…
4- if you don't know all the previous, you can type only * in search an you will see all eventdata ,all fields from all indexes and sources.
docs.splunk.com/Documentation/Splunk/6.2.2/Search/Whatsinthismanual
Hi @luckymaddy
What exactly are you trying to test? Are you trying to see if your indexed data is searchable?
In Splunk app for Enterprise security what are the basic search commands we can run to test the security of the applications/servers that are integrated to Splunk?