Searching for data from different log files with similar field names

[william_choo]

Hi,

I'm new to Splunk here...  

I have a local instance of Splunk Enterprise on my local machine where I've created a data input via Data Input > Files & Directories, and then created an Index which I then map the data input to.

Within this folder, I've dumped various types of log files from different formats / types of web servers e.g. Apache webserver and IIS , even JSON-formatted log files for analysis. 

When I do search for a field name that exists in log files from different formats, does the search results come out for both? Is there any link/doc that explains the best practices or how Splunk behaves with regards to how data is indexed in this circumstance?

Thanks in advance.

[william_choo]

Hello @bowesmana 

Thank you for the advice! Yes I've actually been doing quite a bit of 'unstructured' learning, hopping here and there and also viewing youtube tutorials... I guess I was speeding thru the search fundamentals and missed out some essentials. I was able to create my own Splunk app to ingest some logs but realized I didn't fully understand some of the basics which were crucial for analysis.

Thanks once again for the links!

[bowesmana · Accepted solution]

Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.

Yes, if you search 

index=* field=x

then it will find all data from the indexes where the events have a field called 'field' with the value x

I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain