Hi ,
How do I fetch the raw logs for the source type :wms_oracle_sessions?
Query:
index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=ew | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program
Thank you very much.
Regards,
Rahul
index=main sourcetype=wms_oracle_sessions
gives you the raw logs.
If you want to see the raw logs from the stats in your query, run it in verbose mode and look at the events
Hi @ITWhisperer ,
When I run the query,I see No Results found .
Does that mean there is no raw logs?
Regards,
Rahul
Correct - as it suggests, try a different time period
Hi @ITWhisperer ,
The sourcetype=wms_oracle_sessions take the inputs from two oracle servers Ind1ora01 & Indora02.
Can we some how find , which logs it is taking as a Input.
Regards,
Rahul
I assume you have forwarders on the oracle servers which as configured to harvest logs and send them to the indexers in splunk. You need to look at the configuration of those to find out which paths they are using to find logs to send.