Splunk Search

Splunk Fundamentals Module 5

avergar5
Engager

Hi, I am testing out Splunk Fundamentals 1, and on Module 5 of the lab portion, after running the search, I am not getting any events.

I have tried in both admin, and user roles, and have tested the presets for all time, previous year, previous month, etc. 

Labels (1)

Funderburg78
Path Finder

try typing: index=*  sourcetype=linux_secure  

I think your problem is splunk often wants an index unless you have default index lookups configured in splunk which seeing you are in fundamentals 1, you probably do not.  ig that does not work, try just typeing: index!=_*

This should return any data in any index except for splunk specific logs data.  This will tell you for sure you have some data or not.  Also, then see if in the interesting columns under sourcetype, you see the sourcetype you are looking for.

0 Karma

Funderburg78
Path Finder

since I do not have the lab guide, maybe if you post the query you typed in we can see if there is a mistake.

0 Karma

Floyd22
Engager

I was reading your reply and I have the same problem in Splunk Fundamental Lab 5. In the instruction we are instructed to use the "fail*AND password" command over ALL TIME. I got no results.  I used your "index!=_*" command got goo d results. But what does that do? The "fail* AND password" still doe not return anything. Your help is greatly appreciated.

Tags (2)
0 Karma

Funderburg78
Path Finder

index!=_* returns all data from all indexes except the Splunk system indexes.  Now that you know you have data, try:

index!=_* "fail*" AND "password"

 

 

0 Karma

avergar5
Engager

mod 5.PNG

 

I successfully uploaded this data, but I cannot even get results when I search:

sourcetype=linux_secure

 

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...