How search works

Splunk includes a powerful search language for crafting simple to sophisticated searches. To learn more about Splunk's search syntax, see the User Manual search reference section. Here are a few other things you can do with your searches.

Saved searches

Saved searches are search strings that have been saved for reuse. Saving a search allows for capture of useful and lengthy strings. Splunk ships with a few pre-configured, useful saved searches.

Share a saved search or save it as private. Shared and personally owned private saved searches appear by default on the bottom of the landing page.

Saved searches allow for knowledge capture and sharing. Splunk administrators can create saved searches to distribute to all their Splunk users. You may wish to distribute saved searches in configuration directories to other systems in your data center. Learn more about configuration directories.

Form search and Macro search

Macro searches are saved searches with variables. Fill in the variables at search time.

Form searches work just like macro searches, but include an additional interface for searching.

Alerting

Set any saved search to run on a specific schedule, trigger alerts, send emails or RSS feeds. Learn more about setting up alerts via Splunk Web or the savedsearches.conf file.

Alerts can also trigger shell scripts. This is one way to configure Splunk to work with other applications. Two examples include sending SNMP traps and sending syslog events.

Live tail

Use Live tail to watch data streaming into Splunk. Live tail works just like tail -f in *nix systems. Learn more about live tail.

Summary indexing

Summary indexing provides support for greater efficiency when running reports on large datasets over large time spans. Summary indexing saves the results of a scheduled search into a special summary index that you designate. You can then search and run reports on this smaller, specially generated summary index instead of working with the much larger original data set.

You can use summary indexing to:

index aggregate results
index running statistics (such as a running total)
index rare original events into a smaller index for more efficient reporting

For example, you may want to run a report at the end of every month that tells you how many page views and visitors each of your Web sites had, broken out by site. If you just run this report at the end of the month, it could take a very long time to run because Splunk has to look through a great deal of data to extract the information you want. However, if you use summary indexing, you schedule a saved search that runs periodically over smaller slices of time and Splunk saves the results (since the last time the report was run) into a special (summary) index. You can then run an "end of the month" report on the data indexed in this much smaller index.

Or, you may want to run a report that shows a running count of a statistic over a long period of time. For example, you may want a running count of downloads of a file from a Web site you manage. Schedule a saved search to return the total number of downloads over a specified slice of time. Use summary indexing to have Splunk save the results into a summary index. You can then run a report any time you want on the data in the summary index to obtain the latest count of the total number of downloads.

Learn more about Summary indexing.

Previous: Transaction search | Next: Set up saved searches

Comments

No comments have been submitted.