Splunk Search

Splunk Fundamentals Module 5

avergar5
Engager

Hi, I am testing out Splunk Fundamentals 1, and on Module 5 of the lab portion, after running the search, I am not getting any events.

I have tried in both admin, and user roles, and have tested the presets for all time, previous year, previous month, etc. 

Labels (1)

Funderburg78
Path Finder

try typing: index=*  sourcetype=linux_secure  

I think your problem is splunk often wants an index unless you have default index lookups configured in splunk which seeing you are in fundamentals 1, you probably do not.  ig that does not work, try just typeing: index!=_*

This should return any data in any index except for splunk specific logs data.  This will tell you for sure you have some data or not.  Also, then see if in the interesting columns under sourcetype, you see the sourcetype you are looking for.

0 Karma

Funderburg78
Path Finder

since I do not have the lab guide, maybe if you post the query you typed in we can see if there is a mistake.

0 Karma

Floyd22
Engager

I was reading your reply and I have the same problem in Splunk Fundamental Lab 5. In the instruction we are instructed to use the "fail*AND password" command over ALL TIME. I got no results.  I used your "index!=_*" command got goo d results. But what does that do? The "fail* AND password" still doe not return anything. Your help is greatly appreciated.

Tags (2)
0 Karma

Funderburg78
Path Finder

index!=_* returns all data from all indexes except the Splunk system indexes.  Now that you know you have data, try:

index!=_* "fail*" AND "password"

 

 

0 Karma

avergar5
Engager

mod 5.PNG

 

I successfully uploaded this data, but I cannot even get results when I search:

sourcetype=linux_secure

 

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...