- Splunk 7 Essentials（Third Edition）
- J P Contreras Erickson Delgado Betsy Page Sigman
- 353字
- 2021-08-27 19:37:54
Running a simple search
You are ready to run your first Splunk search:
- Click directly on the green Search & Reporting app button. In this example, you use Splunk's very own internal index; this is Splunk's way of splunking itself (or collecting detailed information on all its underlying processes).
An index is the term given to where Splunk stores event data captured from log files, APIs, HTTP events, delimited files, and other machine data sources. It is in some ways like a database, but should not be compared to traditional relational databases in functionality or performance.
- In the New Search input, type in the following search query (more about the Search Processing Language (SPL) in Chapter 3, Search Processing Language):
SPL> index=_internal sourcetype=splunkd
The SPL> prefix will be used as a convention in this book to indicate a Splunk Search command . Since SPL is submitted via the Splunk user interface, there is no difference whether operating in Windows or Linux environments. The underscore before the index name _internal means that it is a system index internally used by Splunk. Omitting the underscore will not yield any result, as internal is not a default index.
- This search query will have as an output the raw events from the metrics.log file that is stored in the _internal index. A log file keeps track of every event that takes place in the system. The _internal index keeps track of every event that occurs and makes it easily accessible.
- Take a look at these raw events, as shown in the following screenshot. You will see fields listed on the left side of the screen. The important Selected Fields are host, source, and sourcetype. We will go into more detail about these later, but suffice to say that you will frequently search on one of these, as we have done here. As you can see from the highlighted fields, we indicated that we were looking for events where sourcetype=splunkd. Underneath Selected Fields, you will see Interesting Fields. As you can tell, the purposes of many of these fields are easy to guess as seen in the following screenshot:
推薦閱讀
- AWS：Security Best Practices on AWS
- VMware Performance and Capacity Management（Second Edition）
- Supervised Machine Learning with Python
- 現代傳感技術
- Spark大數據技術與應用
- Ceph：Designing and Implementing Scalable Storage Systems
- Windows Server 2003系統安全管理
- Spatial Analytics with ArcGIS
- Dreamweaver+Photoshop+Flash+Fireworks網站建設與網頁設計完全實用
- 與人共融機器人的關節力矩測量技術
- 穿越計算機的迷霧
- 單片機C51應用技術
- 單片機原理、接口及應用系統設計
- 計算機仿真技術
- 智能機器人創新熱點與趨勢