Splunk Search

help fixing cli search with sourcetype specified

alfredoh14
Loves-to-Learn Lots

when i type in the command line (cmd not powershell):
splunk search "*" -maxout 0 | find /c /v ""

I get the return of about 195k records.

however when i filter by one of the sourcetype, from one of the splunk free tutorials, by typeing:
splunk search "*" 'sourcetype=e' -maxout 0 | find /c /v ""

I still get the same result of 195k records.

the "| find /c /v "" " should return only the line count.
so if i filter by the sourcetype it should return around 165k records which are the number of records associated with that source type currently in my splunk db.

can someone help me correct my syntax, i tried google searches but none were able to give me an example, which I think is due to the fact I do not know how the syntax should work in the first place.
I am using the windows cmd, and I plan to use the windows cmd, not the website interface, thanks for understanding.

Labels (1)
0 Karma

tscroggins
Motivator

@alfredoh14 

In your examples, "*" is your search string. To expand it, add search terms to that string:

splunk search "* sourcetype=e" -maxout 0 | find /c /v ""

To dispense with find and have Splunk report the event count:

splunk search "* sourcetype=e | stats count"

If you know the index you're searching, you can use tstats for much faster results:

splunk search "| tstats count where index=main sourcetype=e"

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...