Splunk Search

Splunk Fundamentals Module 5

avergar5
Engager

Hi, I am testing out Splunk Fundamentals 1, and on Module 5 of the lab portion, after running the search, I am not getting any events.

I have tried in both admin, and user roles, and have tested the presets for all time, previous year, previous month, etc. 

Labels (1)

Funderburg78
Path Finder

try typing: index=*  sourcetype=linux_secure  

I think your problem is splunk often wants an index unless you have default index lookups configured in splunk which seeing you are in fundamentals 1, you probably do not.  ig that does not work, try just typeing: index!=_*

This should return any data in any index except for splunk specific logs data.  This will tell you for sure you have some data or not.  Also, then see if in the interesting columns under sourcetype, you see the sourcetype you are looking for.

0 Karma

Funderburg78
Path Finder

since I do not have the lab guide, maybe if you post the query you typed in we can see if there is a mistake.

0 Karma

Floyd22
Engager

I was reading your reply and I have the same problem in Splunk Fundamental Lab 5. In the instruction we are instructed to use the "fail*AND password" command over ALL TIME. I got no results.  I used your "index!=_*" command got goo d results. But what does that do? The "fail* AND password" still doe not return anything. Your help is greatly appreciated.

Tags (2)
0 Karma

Funderburg78
Path Finder

index!=_* returns all data from all indexes except the Splunk system indexes.  Now that you know you have data, try:

index!=_* "fail*" AND "password"

 

 

0 Karma

avergar5
Engager

mod 5.PNG

 

I successfully uploaded this data, but I cannot even get results when I search:

sourcetype=linux_secure

 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...