Splunk Search

search command to select specific fields

Path Finder

What is the search command to search for a disk monitor log such you do in a database. for example, I would like to pick up just the physical reads/sec events.

I just know how to come up with the event count.

Thank you

Tags (1)
0 Karma
1 Solution

Motivator

If the fields are already being extracted, and you're trying to search on a specific value, you can just add that field to your search, e.g., sourcetype=databaselog foo=123. You should also be able to see that field in the field picker at the left side of the screen.

If you don't see the fields you're looking for, they probably are not being extracted yet. Assuming that is the case, then you have a few options:

  • Define a new field extraction so that the field is always there.
  • Use the `rex` command to do a one-time extraction within your search results.
  • If the data is in table form, use `multikv` to split out the events.

Take a look through the User Manual at http://www.splunk.com/base/Documentation/ -- there's a lot of good information there on this sort of thing.

To get you started, try these:

  • Extract fields interactively in Splunk Web http://www.splunk.com/base/Documentation/latest/User/InteractiveFieldExtractionExample
  • Search Reference - multikv
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Multikv
  • Search Reference - rex
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Rex
  • Search Language Cheat Sheet
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/SearchCheatSheet
  • View solution in original post

    Path Finder

    yes. That´s it. Basically, I am trying to create a line chart where I can display... let's say ... when was the pick of disk writting.

    0 Karma

    Motivator

    Not quite clear on what you are trying to do. Are you trying to display a single field in the results?

    Motivator

    If the fields are already being extracted, and you're trying to search on a specific value, you can just add that field to your search, e.g., sourcetype=databaselog foo=123. You should also be able to see that field in the field picker at the left side of the screen.

    If you don't see the fields you're looking for, they probably are not being extracted yet. Assuming that is the case, then you have a few options:

    • Define a new field extraction so that the field is always there.
    • Use the `rex` command to do a one-time extraction within your search results.
    • If the data is in table form, use `multikv` to split out the events.

    Take a look through the User Manual at http://www.splunk.com/base/Documentation/ -- there's a lot of good information there on this sort of thing.

    To get you started, try these:

  • Extract fields interactively in Splunk Web http://www.splunk.com/base/Documentation/latest/User/InteractiveFieldExtractionExample
  • Search Reference - multikv
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Multikv
  • Search Reference - rex
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Rex
  • Search Language Cheat Sheet
    http://www.splunk.com/base/Documentation/4.1.5/SearchReference/SearchCheatSheet
  • View solution in original post

    Motivator

    Also, I should have thought of it earlier, but is your data in table form (header row plus multiple lines)? If so, you can save a lot of effort by just using the multikv command, also added above.

    0 Karma

    Motivator

    I don't know enough to speak either way about the virtual class, but it might be an option. If you're trying to learn the search language, a good place to start is with the searches that are bundled with Splunk and with various apps. Install a couple of apps and take a look at how they wrote their searches, and maybe that will help you come up with ideas on how to approach different problems. Another great place to start is with the Search Cheat Sheet -- I've edited the post above to add the link.

    0 Karma

    Path Finder

    Thank you southeringtonp I have already read a some of the documentation, but i still got doubts about the search language. Despite the splunk documantation, the other source to study is the splunk virtual class, right ? Is it really good to start ???

    0 Karma
    Don’t Miss Global Splunk
    User Groups Week!

    Free LIVE events worldwide 2/8-2/12
    Connect, learn, and collect rad prizes
    and swag!