Splunk Fundamentals Module 5

[avergar5]

Hi, I am testing out Splunk Fundamentals 1, and on Module 5 of the lab portion, after running the search, I am not getting any events.

I have tried in both admin, and user roles, and have tested the presets for all time, previous year, previous month, etc. 

[Funderburg78]

try typing: index=*  sourcetype=linux_secure  

I think your problem is splunk often wants an index unless you have default index lookups configured in splunk which seeing you are in fundamentals 1, you probably do not.  ig that does not work, try just typeing: index!=_*

This should return any data in any index except for splunk specific logs data.  This will tell you for sure you have some data or not.  Also, then see if in the interesting columns under sourcetype, you see the sourcetype you are looking for.

[Funderburg78]

since I do not have the lab guide, maybe if you post the query you typed in we can see if there is a mistake.

[Floyd22]

I was reading your reply and I have the same problem in Splunk Fundamental Lab 5. In the instruction we are instructed to use the "fail*AND password" command over ALL TIME. I got no results.  I used your "index!=_*" command got goo d results. But what does that do? The "fail* AND password" still doe not return anything. Your help is greatly appreciated.

[Funderburg78]

index!=_* returns all data from all indexes except the Splunk system indexes.  Now that you know you have data, try:

index!=_* "fail*" AND "password"

[avergar5]

mod 5.PNG

I successfully uploaded this data, but I cannot even get results when I search:

sourcetype=linux_secure