Search for device type

[brian_runyon]

I want to determine how many times a call has been completed or attempted by searching for a specic device name/type (ex. ABC12345).

I've tried sourcetype=ABC*, sourcetype="ABC*" and get no results.

Thank you!

[sdaniels · Accepted solution]

I'm not sure what kind of data you are looking at but sourcetype classifies the type of data. So, for example access_combined apache web logs, or Windows Event logs etc....Go to Manager -> Search App. Then you'll see a summary of sources, sourcetypes and hosts. You can click on one of those links and it will modify your search specifically to that type of data.

Just put ABC in the your search bar and that will give you what you are looking for or something like host="ABC*" OR host="AB*" etc...which would be more specific than just searching for ABC*.

Take a look at some examples here:

http://docs.splunk.com/Documentation/Splunk/latest/User/Searchexamplestutorial

[brian_runyon]

I think I may have found my answer.

index=eucp | eventstats count(SEP*)