Splunk Search

Searching for data from different log files with similar field names

william_choo
Explorer

Hi,

I'm new to Splunk here...  

I have a local instance of Splunk Enterprise on my local machine where I've created a data input via Data Input > Files & Directories, and then created an Index which I then map the data input to.

Within this folder, I've dumped various types of log files from different formats / types of web servers e.g. Apache webserver and IIS , even JSON-formatted log files for analysis. 

When I do search for a field name that exists in log files from different formats, does the search results come out for both? Is there any link/doc that explains the best practices or how Splunk behaves with regards to how data is indexed in this circumstance?

Thanks in advance.

Labels (1)
0 Karma
1 Solution

bowesmana
Super Champion

Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.

Yes, if you search 

index=* field=x

then it will find all data from the indexes where the events have a field called 'field' with the value x

I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain

 

 

View solution in original post

0 Karma

william_choo
Explorer

Hello @bowesmana 

Thank you for the advice! Yes I've actually been doing quite a bit of 'unstructured' learning, hopping here and there and also viewing youtube tutorials... I guess I was speeding thru the search fundamentals and missed out some essentials. I was able to create my own Splunk app to ingest some logs but realized I didn't fully understand some of the basics which were crucial for analysis.

Thanks once again for the links!

bowesmana
Super Champion

Generally you would segregate your different log types into separate indexes and sourcetypes. The 'source' field will generally be the file (if it comes from a file) the data came from and sourcetype is based on your ingestion rules.

Yes, if you search 

index=* field=x

then it will find all data from the indexes where the events have a field called 'field' with the value x

I suggest you do the free Splunk Fundamentals 1 course and also read about getting data in

https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

https://docs.splunk.com/Documentation/Splunk/8.2.0/Data/Getstartedwithgettingdatain

 

 

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!