Splunk's _internal logs also maintains log_level as "INFO", "ERROR","WARN" and "FATAL". So with a query like this you can search for the Splunk component which has always thrown error. For example after upgrade , install or config change etc. to isolate the issue. There could be several different use cases on similar lines. ... View more