Splunk search contains software#

Some examples of these searches include: counting the number of errors that occurred or finding all events from a specific host. Dense searches are searches that scan through and report on many events.Some examples of these searches include: searching for a specific and unique IP address or error code. You have probably heard these referred to as 'needle in a haystack' or 'rare term' searches. Sparse searches are searches that look for a single event or an event that occurs infrequently within a large set of data.Whether you are retrieving raw events or building a report, you should also consider whether you are running a search for sparse or dense information: Read more about transforming searches and commands starting with the topic About transforming commands and searches.Read more about using subsearches to filter results in About subsearches.Read more about the structure of a search in About the search processing language syntax.Some examples include: getting a daily count of error events, counting the number of times a specific user has logged in, or calculating the 95th percentile of field values. These searches will always require fields and at least one of a set of statistical commands. These are searches where you first retrieve events from an index and then pass the events into one or more search commands. Transforming searches are searches that perform some type of statistical calculation against a set of results. Read more about raw event searches starting with the topic About retrieving events.These searches do not usually include search commands (except search itself), and the results are typically a list of raw events. Some examples of these searches include: checking error codes, correlating events, investigating security issues, and analyzing failures. Raw event searches are searches that just retrieve events from an index or indexes, and are typically used when you want to analyze a problem. Summarize your search results into a report, whether tabular or other visualization format.īecause of this, you might hear us refer to two types of searches: Raw event searches and transforming searches.Investigate to learn more about the data you just indexed or to find the root cause of an issue.Generally, after getting data into your Splunk deployment, you want to: This capturing of knowledge helps you to construct more efficient searches and build more detailed reports.īefore delving into the language and syntax of search, you should ask what you are trying to accomplish. Whatever you learn, you can use, add, and edit this knowledge about fields, events, and transactions to your event data.

Splunk search contains software#

You can configure Splunk software to recognize these new fields as you index new data, or you can create new fields as you search. As you search, you will begin to recognize patterns and identify more information that can be useful as searchable fields.