Splunk is a log indexing/searching tool.
thoroughly read manual, organize and document with query syntax filed under SPL2
official docs https://docs.splunk.com/Documentation/Splunk search docs https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/GetstartedwithSearch
Splunk queries will show up within splunk. Allowlist your host, or denylist splunk hosts.searchterm host!=host.domain.com
Time Ranges# earliest/latest can be specified in searchbar # and can use relative time ranges # # DateFmt: %m/%d/%Y:%H:%M:%S # # Timezone of UTC is assumed Error earliest=07/06/2020:17:57:05 latest=+10m earliest=08/26/2020:15:00:00 # like watching logsearchterm earliest=07/06/2020:17:57:05 latest=+10m | rex "id=(?<id>\d+)" # regex match, extract 'id' | where status="404" # select by attribute values | dedup id # remove duplicate results | table id colA # select only these fields in result
Operatorsusers IN(will,alex,maize) # grouped or statements user=will OR user=alex # statements separated by or (note parentheses inneffective)
sorting is performed over a field.
if it is not already defined, you can extract a field with
rex."SELECT * FROM" | rex field=_raw "(?<query_duration>\(\d+\.\d+ms\))" # assigns 'query_duration' field | sort query_duration # sorts results by 'query_duration'