Splunk Search

Raw Logs

rahul2gupta
Path Finder

Hi ,

How do I fetch the raw logs for the source type :wms_oracle_sessions?

Query:

index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=ew | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program

Thank you very much.

Regards,

Rahul

Labels (1)
0 Karma

ITWhisperer
Ultra Champion
index=main sourcetype=wms_oracle_sessions

gives you the raw logs.

If you want to see the raw logs from the stats in your query, run it in verbose mode and look at the eventsCapture.PNGCapture.PNG

0 Karma

rahul2gupta
Path Finder

Hi @ITWhisperer ,

When I run the query,I see No Results found .

Does that mean there is no raw logs?

rahul2gupta_0-1600932126959.png

Regards,

Rahul

 

Tags (1)
0 Karma

ITWhisperer
Ultra Champion

Correct - as it suggests, try a different time period

0 Karma

rahul2gupta
Path Finder

Hi @ITWhisperer ,

The sourcetype=wms_oracle_sessions take the inputs from two oracle servers Ind1ora01 & Indora02.

Can we some how find , which logs it is taking as a Input.

Regards,

Rahul

0 Karma

ITWhisperer
Ultra Champion

I assume you have forwarders on the oracle servers which as configured to harvest logs and send them to the indexers in splunk. You need to look at the configuration of those to find out which paths they are using to find logs to send.

0 Karma