Splunk search

Searching in Splunk is easy - type any term you'd expect to find in your data into the search box and hit Enter. A Splunk search lets you search indexed data in real-time, extract data from search results, and produce meaningful reports from the data you put into Splunk. For example, to search for all events containing a given IP address, type it into the box. Try it with usernames, error codes, transaction IDs, or whatever else you are looking for.

See the Search syntax page to learn about Splunk search syntax.

A search is pipeline of commands (similar to a Unix "|" pipeline) that starts with a command that gathers data (typically a search on data in a Splunk index), followed by data-processing commands that operate on the data to yield search results.

See the Search pipeline syntax page for details about the syntax of the search pipeline.

You can also watch this Splunk developer video about searching with Splunk.

Generate search results

Generate search results by using a data-generating command. Generate search results by using:

search to get new search results from a Splunk index.
savedsearch to execute a saved search.
file to import previously gathered search results directly from a file.
crawl to search your filesystem for new data sources to add to your index (returns them as search results).

Construct searches

Use the search command to construct simple keyword searches on data in your Splunk index (just like a Google search). Narrow your keyword searches with modifiers, fields, Boolean operators, and logical comparison operators.

You can also construct more powerful searches by using additional commands to extract data, perform statistical operations, and build reports. Learn about the search commands in the search command reference.

Here are some valuable points to remember when constructing a search:

When generating data

To get more results:

Increase the time range (search over all time to get the most number of results).
Use wildcards and partial keywords instead of exact keywords.

If you want a faster search:

Narrow the time range of your search.
Reduce the number of fields that are extracted by un-selecting fields in the Fields picker menu.
Reduce the segmentation by selecting inner, outer, or raw in the Preferences menu (reducing segmentation makes extracting and reporting more difficult).

When narrowing your search

Filter results by event type if possible.
Use the source and sourcetype fields to narrow a search to only a specified source.
Use a combination of logical and Boolean expressions of keywords, modifiers, and fields.

Types of search

Form searches

Form searches are reusable searches that are pre-defined by a Splunk administrator. Form searches allow you to run complex searches by simply inputting variables in form fields. Learn more about Form searches.

Macro searches

Macro searches allow macro substitution of variables in saved searches. This allows you to run a complex search repeatedly with different variables. Learn more about Macro searches.

Transaction searches

Transactions let you search for groups of related events that are pre-defined as a transaction by your Splunk administrator. Use the transaction command to execute a transaction search. You can override specifications of a pre-defined transaction, or define a new transaction with the transaction command. Learn more about Transactions.

Live tail

Live tail allows you to see data as its being indexed into Splunk in real-time (similar to Unix's tail -f command). Live tail allows you to execute a simple search in its stand-alone window, and monitor events that match the search. Find out more about live tail.

Asynchronous searches

The Splunk CLI allows you to run multiple searches asynchronously. Use this if you have a search or report you want to run on a large amount of data where the search could take days and you still want to be able to run other searches with Splunk. Use the dispatch CLI command to execute asynchronous searches. Learn more about asynchronous searches.

CLI searches

Run searches in the CLI with the search CLI command. Searches in the CLI work the same way as searches in Splunk Web except there is no timeline rendered with the search results, and a time range isn't specified by default. Search for anything by including your search as the 'search string' argument of a CLI search command.

Learn more about CLI searching.

Save and schedule searches

After you save a search, you can set your searches to run regularly and schedule alert conditions. Read more about Save, schedule, and alert options.

Tune search performance

Splunk's searches are optimized for text-based searching of raw event data. Search speed is dependent on how your Splunk install is configured. You can improve the speed of your searches by editing configuration files, and by downloading various add-ons from SplunkBase. Read more about tuning search performance.

Previous: Delete an index | Next: Form search

Comments

No comments have been submitted.