Splunk Search

search command to select specific fields

Caio_Santos
Path Finder

What is the search command to search for a disk monitor log such you do in a database. for example, I would like to pick up just the physical reads/sec events.

I just know how to come up with the event count.

Thank you

Tags (1)
0 Karma
1 Solution

southeringtonp
Motivator

If the fields are already being extracted, and you're trying to search on a specific value, you can just add that field to your search, e.g., sourcetype=databaselog foo=123. You should also be able to see that field in the field picker at the left side of the screen.

If you don't see the fields you're looking for, they probably are not being extracted yet. Assuming that is the case, then you have a few options:

  • Define a new field extraction so that the field is always there.
  • Use the `rex` command to do a one-time extraction within your search results.
  • If the data is in table form, use `multikv` to split out the events.

Take a look through the User Manual at http://www.splunk.com/base/Documentation/ -- there's a lot of good information there on this sort of thing.

To get you started, try these:

  • Extract fields interactively in Splunk Web http://www.splunk.com/base/Documentation/latest/User/InteractiveFieldExtractionExample
  • Search Reference - multikv
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Multikv
  • Search Reference - rex
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Rex
  • Search Language Cheat Sheet
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/SearchCheatSheet
  • View solution in original post

    Caio_Santos
    Path Finder

    yes. That´s it. Basically, I am trying to create a line chart where I can display... let's say ... when was the pick of disk writting.

    0 Karma

    ftk
    Motivator

    Not quite clear on what you are trying to do. Are you trying to display a single field in the results?

    southeringtonp
    Motivator

    If the fields are already being extracted, and you're trying to search on a specific value, you can just add that field to your search, e.g., sourcetype=databaselog foo=123. You should also be able to see that field in the field picker at the left side of the screen.

    If you don't see the fields you're looking for, they probably are not being extracted yet. Assuming that is the case, then you have a few options:

    • Define a new field extraction so that the field is always there.
    • Use the `rex` command to do a one-time extraction within your search results.
    • If the data is in table form, use `multikv` to split out the events.

    Take a look through the User Manual at http://www.splunk.com/base/Documentation/ -- there's a lot of good information there on this sort of thing.

    To get you started, try these:

  • Extract fields interactively in Splunk Web http://www.splunk.com/base/Documentation/latest/User/InteractiveFieldExtractionExample
  • Search Reference - multikv
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Multikv
  • Search Reference - rex
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Rex
  • Search Language Cheat Sheet
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/SearchCheatSheet
  • southeringtonp
    Motivator

    Also, I should have thought of it earlier, but is your data in table form (header row plus multiple lines)? If so, you can save a lot of effort by just using the multikv command, also added above.

    0 Karma

    southeringtonp
    Motivator

    I don't know enough to speak either way about the virtual class, but it might be an option. If you're trying to learn the search language, a good place to start is with the searches that are bundled with Splunk and with various apps. Install a couple of apps and take a look at how they wrote their searches, and maybe that will help you come up with ideas on how to approach different problems. Another great place to start is with the Search Cheat Sheet -- I've edited the post above to add the link.

    0 Karma

    Caio_Santos
    Path Finder

    Thank you southeringtonp I have already read a some of the documentation, but i still got doubts about the search language. Despite the splunk documantation, the other source to study is the splunk virtual class, right ? Is it really good to start ???

    0 Karma
    Get Updates on the Splunk Community!

    Fueling your curiosity with new Splunk ILT and eLearning courses

    At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

    Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

    Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

    Unleash Unified Security and Observability with Splunk Cloud Platform

         Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...