Splunk Fundamentals 1 Module 5 question

[Marqui]

In module 5, of Splunk Fundamentals 1, during the lab exercise, it asks to do a search and says to notice the host=web_server results and host=web_application, however,  there are no host=web_server results. So in the second search when they say put "port 22" in the search string, there are no results. I cannot finish the module. Any suggestions?

[tscroggins]

@Marqui 

It's been years since I've taken the course, but a quick look at the lab guide for Module 5 Task 2 reads:

7. Click Search to start a new search.
8. Search for fail* AND password over All time. Review the results and notice the port values for a few of the events. You want to see users trying to log into the SSH port we have open, port 22.
9. At the end of the search string, type: 22
10. Click the Search button or press Enter to run the search.
11. Notice that not only events with port 22 are selected, but any events with the number 22 in them.
12. Replace the number 22 in your search with: "port 22". Make sure to use the quotation marks.
13. Notice that you are now only seeing events the entire phase.
14. Page through the results. There are many login failures.

In step 12, your search should be:

fail* AND password "port 22"

Assuming the lab and test data agree, you should see results with host=web_server sourcetype=linux_secure.