Splunk Search

Search by file name?

dgarstang
Engager

As an admin that's used to searching logs with /bin/less, ? and /, I find the Splunk web interface pretty confusing.

How can I limit searches in the web UI to specific source file names? In fact, I can't even see where Splunk even shows the name of the file that searches appeared in. This is really confusing. If I don't know what file a match was in, I really have no context of what I am seeing.

Doug.

Tags (1)
1 Solution

chris
Motivator

Hi Doug

You can search for a specific file by specifying a file name for the source in the search field. In the example "spam" and "bytes" are the searchterms and the first part (source=/directory/file.log) limits the search to a source which is a file in this case

If you select the source as a field using "Pick fields" every event ( this usually corresponds to one line in a logfile) will show it's source.

alt text

I hope this helps

Chris

View solution in original post

chris
Motivator

Hi Doug

You can search for a specific file by specifying a file name for the source in the search field. In the example "spam" and "bytes" are the searchterms and the first part (source=/directory/file.log) limits the search to a source which is a file in this case

If you select the source as a field using "Pick fields" every event ( this usually corresponds to one line in a logfile) will show it's source.

alt text

I hope this helps

Chris

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...