Splunk Search

Searching for data from different log files with similar field names

william_choo
Explorer

Hi,

I'm new to Splunk here...  

I have a local instance of Splunk Enterprise on my local machine where I've created a data input via Data Input > Files & Directories, and then created an Index which I then map the data input to.

Within this folder, I've dumped various types of log files from different formats / types of web servers e.g. Apache webserver and IIS , even JSON-formatted log files for analysis. 

When I do search for a field name that exists in log files from different formats, does the search results come out for both? Is there any link/doc that explains the best practices or how Splunk behaves with regards to how data is indexed in this circumstance?

Thanks in advance.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.

Yes, if you search 

index=* field=x

then it will find all data from the indexes where the events have a field called 'field' with the value x

I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain

 

 

View solution in original post

0 Karma

william_choo
Explorer

Hello @bowesmana 

Thank you for the advice! Yes I've actually been doing quite a bit of 'unstructured' learning, hopping here and there and also viewing youtube tutorials... I guess I was speeding thru the search fundamentals and missed out some essentials. I was able to create my own Splunk app to ingest some logs but realized I didn't fully understand some of the basics which were crucial for analysis.

Thanks once again for the links!

bowesmana
SplunkTrust
SplunkTrust

Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.

Yes, if you search 

index=* field=x

then it will find all data from the indexes where the events have a field called 'field' with the value x

I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain

 

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...