Splunk Search

Searching for data from different log files with similar field names

william_choo
Explorer

Hi,

I'm new to Splunk here...  

I have a local instance of Splunk Enterprise on my local machine where I've created a data input via Data Input > Files & Directories, and then created an Index which I then map the data input to.

Within this folder, I've dumped various types of log files from different formats / types of web servers e.g. Apache webserver and IIS , even JSON-formatted log files for analysis. 

When I do search for a field name that exists in log files from different formats, does the search results come out for both? Is there any link/doc that explains the best practices or how Splunk behaves with regards to how data is indexed in this circumstance?

Thanks in advance.

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.

Yes, if you search 

index=* field=x

then it will find all data from the indexes where the events have a field called 'field' with the value x

I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain

 

 

View solution in original post

0 Karma

william_choo
Explorer

Hello @bowesmana 

Thank you for the advice! Yes I've actually been doing quite a bit of 'unstructured' learning, hopping here and there and also viewing youtube tutorials... I guess I was speeding thru the search fundamentals and missed out some essentials. I was able to create my own Splunk app to ingest some logs but realized I didn't fully understand some of the basics which were crucial for analysis.

Thanks once again for the links!

bowesmana
SplunkTrust
SplunkTrust

Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.

Yes, if you search 

index=* field=x

then it will find all data from the indexes where the events have a field called 'field' with the value x

I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain

 

 

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...