Raw Logs

[rahul2gupta]

Hi ,

How do I fetch the raw logs for the source type :wms_oracle_sessions?

Query:

index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=ew | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program

Thank you very much.

Regards,

Rahul

[ITWhisperer]

index=main sourcetype=wms_oracle_sessions

gives you the raw logs.

If you want to see the raw logs from the stats in your query, run it in verbose mode and look at the events

[rahul2gupta]

Hi @ITWhisperer ,

When I run the query,I see No Results found .

Does that mean there is no raw logs?

Regards,

Rahul

[ITWhisperer]

Correct - as it suggests, try a different time period

[rahul2gupta]

Hi @ITWhisperer ,

The sourcetype=wms_oracle_sessions take the inputs from two oracle servers Ind1ora01 & Indora02.

Can we some how find , which logs it is taking as a Input.

Regards,

Rahul

[ITWhisperer]

I assume you have forwarders on the oracle servers which as configured to harvest logs and send them to the indexers in splunk. You need to look at the configuration of those to find out which paths they are using to find logs to send.