Splunk
From wikinotes
Splunk is a log indexing/searching tool.
TODO:
thoroughly read manual, organize and document with query syntax filed under SPL2
Documentation
official docs https://docs.splunk.com/Documentation/Splunk search docs https://docs.splunk.com/Documentation/Splunk/8.0.6/Search/GetstartedwithSearch
Query Syntax
Ad-Hoc Log Contents
You can define a record with your own custom fields ad-hoc, and test queries against them.
It executes much more quickly.| makeresults | eval foo=split("a,b,c", ",") | eval c=mvcount(foo)Target Hosts
Splunk queries will show up within splunk. Allowlist your host, or denylist splunk hosts.
searchterm host!=host.domain.com
Time Ranges
# earliest/latest can be specified in searchbar # and can use relative time ranges # # DateFmt: %m/%d/%Y:%H:%M:%S # # Timezone of UTC is assumed Error earliest=07/06/2020:17:57:05 latest=+10m earliest=08/26/2020:15:00:00 # like watching logsearchterm earliest=07/06/2020:17:57:05 latest=+10m | rex "id=(?<id>\d+)" # regex match, extract 'id' | where status="404" # select by attribute values | dedup id # remove duplicate results | table id colA # select only these fields in resultOperators
users IN(will,alex,maize) # grouped or statements user=will OR user=alex # statements separated by or (note parentheses inneffective)Sorting
sorting is performed over a field.
if it is not already defined, you can extract a field withrex
."SELECT * FROM" | rex field=_raw "(?<query_duration>\(\d+\.\d+ms\))" # assigns 'query_duration' field | sort query_duration # sorts results by 'query_duration'