Hi,
I'm new to Splunk here...
I have a local instance of Splunk Enterprise on my local machine where I've created a data input via Data Input > Files & Directories, and then created an Index which I then map the data input to.
Within this folder, I've dumped various types of log files from different formats / types of web servers e.g. Apache webserver and IIS , even JSON-formatted log files for analysis.
When I do search for a field name that exists in log files from different formats, does the search results come out for both? Is there any link/doc that explains the best practices or how Splunk behaves with regards to how data is indexed in this circumstance?
Thanks in advance.
Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.
Yes, if you search
index=* field=x
then it will find all data from the indexes where the events have a field called 'field' with the value x
I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in
https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html
https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain
Hello @bowesmana
Thank you for the advice! Yes I've actually been doing quite a bit of 'unstructured' learning, hopping here and there and also viewing youtube tutorials... I guess I was speeding thru the search fundamentals and missed out some essentials. I was able to create my own Splunk app to ingest some logs but realized I didn't fully understand some of the basics which were crucial for analysis.
Thanks once again for the links!
Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.
Yes, if you search
index=* field=x
then it will find all data from the indexes where the events have a field called 'field' with the value x
I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in
https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html
https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain