Splunk has to segregate the Logs when we imported.

[riyaz551]

Hi

I need to segregate the logs which we imported splunk.

Ex:- I want to extract the logs by using the word error and it should be separate dashboard.

Kindly help on this and give step by step answer.

[sbbadri]

I m assuming you are asking this,
<input type="dropdown" token="search_tok">
<label>Select a log type</label>
<default>error</default>
<choice value="error">error</choice>
<choice value="info">info</choice>
<choice value="warn">warn</choice>

</input>

  <table>
    <search>
      <query>index = xxx sourcetype=y yyy $search_tok$ | table _time _raw </query>
    </search>
  </table>
</panel>

[richgalloway]

It is difficult to give a step-by-step answer to such a vague question. Please explain in more detail what it is you wish to accomplish.

In general, entering "error" into the search bar should find that word in your logs, but it depends on what indexes your account will search by default.

[riyaz551]

Hi richgalloway,

Thanks for reply my question,but.

once i imported error log file in splunk tool by searching date,time, error has to caught in word in dash board

[richgalloway]

I don't understand. What is the exact search query you are using?