Documentation: 3.3
|  Print Version Contents
This page last updated: 11/24/08 03:11pm

Simple searches

See a few simple searches in action. This section introduces keyword searches and how to narrow your search with Boolean logic and using the timeline. Before you begin, you can watch Splunk's developer video about search; it demonstrates how to search with a just a few words and clicks of the mouse.

Index data

Splunk comes with pre-indexed sample data, called sampledata, which we will use throughout this tutorial. You can search the index that has the sample data in it instead of the main index by including index=sampledata in the search criteria.

For help indexing your own data, see the data inputs section of the Admin Manual.

Search

To start, enter your search in the search bar at the top of the page. To search for all the data in the sampledata index, type the following into the search bar:

index=sampledataSearch

http://www.splunk.com/assets/doc-images/SimpleSearches/searchResults.png

The timeline should show bars indicating when matching results occurred. If there are no results displayed, change the time range until you see results.

Now, lets search for HTTP requests that resulted in an internal server error (code 500). Type this simple search:

index=sampledata http 500Search

Narrow your search

You can use arguments in the search command to narrow your search. Add Boolean logic between terms and modifiers, use logical comparison operators for field values, or use search modifiers. You can also use the timeline to zoom in on particular events. This section discusses two ways to apply Boolean modifiers to your search. We'll discuss using the timeline to narrow your results later.

Read Search results for more ways to manipulate search results.

Search with Booleans

Splunk supports the Boolean operators: AND, OR, and NOT (must be capitalized).

Enter the search:

index=sampledata http AND 500Search

Your results should match the previous example search. Similar to Google and other search engines, Splunk implicitly inserts an AND between terms by default.

Note: If your search produces no results, try zooming out, clearing the time range, or resetting the time range using the drop-down menu.

Search for all HTTP requests that do not contain error code 500:

index=sampledata http NOT 500Search

Search for all sampledata events of sourcetype access_common or syslog.

index=sampledata (sourcetype=access_common OR sourcetype=syslog)Search

Note: Splunk uses parentheses to group Boolean expressions.

Click on results

As you scroll through your results and mouse over sections of each event, you'll notice the sections are highlighted. You can highlight and click items in the results to add and remove terms in your search string.

Search for:

index=sampledata httpSearch

Scroll through the list of results. Click on "500" in one of the search results.

http://www.splunk.com/assets/doc-images/SimpleSearches/and500.png

Notice that Splunk highlights and updates the search to add "500" as a term (in the search bar). This is a shortcut for applying the "AND" operator to your search.

index=sampledata http 500Search

Click on another instance of "500". Splunk removes the term from your search string and your search results include all HTTP results again:

index=sampledata httpSearch

Now, alt-click on "200" in any search result (option-click for Mac, alt-shift-click for some popular *nix windows managers).

Splunk now updates your search with "NOT 200"; This is a shortcut for applying the "NOT" operator.

index=sampledata http NOT 200Search

Follow a relationship

While you scroll through the list of results, you may find interesting events. For example, if you want to look only at activity on one particular IP address:

  • click on an IP address (option-click on a Mac).
  • Check Wrap results to turn on line-wrapping for the long single line events that result from searches.

Now, your results are a chronological list of events that occurred on this IP address. You can use this to trace a sequence on events. This is an effective way to follow relationships between events.

Use the timeline

The timeline shows bars and a red line (or flag). The bars indicate the volume of search results and when they occur along the span of your time range.

You can change the time range with the drop-down menu:

  • Choose Custom.
  • Specify a start and end time.

You can also customize the time range by clicking on any bar in the timeline and zooming in on a particular cluster of events:

  • Set the time range to "Last month".
  • Execute the search for all sampledata.

http://www.splunk.com/assets/doc-images/SimpleSearches/timeline1.png

Notice that each bar is equivalent to one day of data.

  • Click on the bar in the timeline showing the cluster of data.
  • Click Zoom in.
  • Repeat the last two actions to narrow the time range until you see a few more bars in the cluster of data.

http://www.splunk.com/assets/doc-images/SimpleSearches/timeline2.png

Notice that each bar is equivalent to one minute of data.

  • Shift-click or drag your mouse across all of the bars and zoom in further.

Note: The red flag marks the location of the results you are currently viewing along the timeline. As you scroll through your search results, the red flag shifts to follow.

http://www.splunk.com/assets/doc-images/SimpleSearches/timeline3.png

The timeline now spans several minutes, with one bar equal to one second.

Note: Your Splunk instance will perform faster if you narrow the time range of your search. Searching over all time may result in slow search performance.

Previous: About this tutorial    |    Next: Search results

Comments

No comments have been submitted.

Log in to comment.