VMware ESXi and vSphere Cluster Management

Example Search in Splunk

Learn how to run basic Splunk keyword searches, restrict searches to an index, interpret Timeline, Fields, and Results, and refine results with extracted fields.

Splunk searches indexed event data. An event is an individual time-stamped record ingested into Splunk. Indexed data is data stored in a Splunk index, a logical storage location that groups event data for searching.

This lesson assumes that data has already been added or indexed and that you can open the Splunk Search interface.

Start a basic event search

Enter a search in the Splunk Search bar. The Search bar is the interface input used to enter and run searches.

  1. Open the Splunk Search interface.
  2. Choose an appropriate time range.
  3. Enter a search expression in the Search bar.
  4. Submit the search.
  5. Review the matching events in the results page.

A search is a query that retrieves events matching specified criteria. The simplest search is a keyword search:

GET

This searches for events containing the text GET. Because no index is specified, Splunk searches the indexes available to your user. The result may include events from unrelated sources if the term is common.

Search within a specific index

When you know which data source contains the events you need, specify its index. An index is the storage and search scope; the keyword is the event-content condition.

index=testindex GET

In this search, index=testindex restricts the search to the testindex index, while GET asks for events whose content includes that term. Keeping these roles separate helps you understand and build searches.

  • Index restriction: limits where Splunk looks.
  • Keyword or content condition: specifies text that must be found in the event.

Index-scoped searches are recommended when the intended data source is known. They generally improve result precision and can reduce search time by preventing Splunk from examining unrelated indexes.

Example: search for GET events

To find HTTP-style request events containing GET in the known index, run:

index=testindex GET

The results contain events in testindex that match the keyword within the selected time range. The displayed count is the number of matching events. It does not necessarily represent the number of unique requests, URLs, clients, or other unique values. Several events can describe the same request, and one event can contain multiple values.

If you do not yet know the index, begin with:

GET

This broader search can help you discover relevant data, but it may return unrelated events and may take longer. After identifying the correct data source, repeat the search with an index restriction.

Understand the search results page

After submitting a search, Splunk presents several areas that help you interpret the matching event set.

Component — Purpose — How a beginner uses it

Timeline — Visualizes the volume of matching events across the selected time range — Look for periods with unusually high or low activity and select a time area for closer inspection.

Fields — Presents named data elements extracted from the matching events — Review available fields and use them to filter or investigate the results.

Results — Displays the raw matching events — Read individual events, inspect their timestamps, and verify why they matched.

Timeline

The Timeline is a visualization of matching-event volume over time. Peaks indicate periods with more matching events; low areas indicate fewer. The Timeline covers the selected time range, so it is useful for spotting activity patterns after an index-scoped keyword search.

For example, run index=testindex GET, then inspect the Timeline for a sudden increase in matching HTTP-style events. This identifies a period for further investigation but does not, by itself, explain the cause of the increase.

Fields

Fields are named data elements extracted from events and made available for filtering or analysis. Depending on the data, fields might include a method, host, source, status, client address, or another value.

Selecting or constraining an extracted field narrows a broad result set. Available fields depend on the event format and the field extraction rules configured for that data. A field shown for one data source might not exist for another.

Results

The Results area displays the raw events that match the submitted search. Use it to confirm the actual text, field names, and field values present in the data.

A timestamp is the date and time associated with an event. Splunk uses timestamps to order displayed events and identify when the event occurred. Inspecting timestamps helps connect individual results to Timeline activity and to the selected time range.

Use fields to refine a search

After reviewing the broad results, add a field constraint when the data contains the field you need. For example:

index=testindex GET status=200

This returns matching GET events in testindex whose extracted status field equals 200, assuming that the field exists and uses this format.

Search goal — Search syntax — Scope of results

Keyword only — GET — Events containing GET in indexes available to the user.

Index plus keyword — index=testindex GET — Events containing GET in the testindex index.

Index plus keyword and field filter — index=testindex GET status=200 — Events containing GET in testindex with an extracted status value of 200.

Field filtering is more precise than relying only on raw text when the field is extracted correctly. If a field cannot be used, review the Fields area and a sample event to confirm the exact field name and format.

Search scope and time awareness

Search results depend on both the search expression and the selected time range. A correct query can return no events if the active time range does not include when those events occurred.

Troubleshoot common search problems

No results are returned

  • Expand or change the selected time range.
  • Verify the index name, including its spelling and capitalization where relevant.
  • Confirm that the data has been indexed and that your user can search the index.
  • Check whether the keyword appears exactly as expected in a known event.
  • Try a broader search without the index restriction to determine whether the scope is the problem.

Too many unrelated events appear

  • Add an index restriction if the correct index is known.
  • Add relevant extracted field constraints.
  • Use more specific terms or Boolean conditions.

A field cannot narrow the results

  • Review the Fields area and sample result events to see whether the field is extracted.
  • Confirm the exact field name and value format.
  • Use raw text searching temporarily if suitable field extraction is not available.

Move from basic searches to advanced syntax

Keyword and index searches provide the foundation for more advanced search rules. As your searches become more specific, Boolean expressions can combine or exclude conditions with operators such as AND, OR, and NOT.

For example, a later search might combine an index restriction with several field or text conditions. First become comfortable identifying the index, keyword, time range, fields, and matching events; then add Boolean logic to express more complex requirements.

Quick review

  • Enter searches in the Splunk Search bar and submit them to retrieve matching indexed events.
  • A keyword-only search such as GET finds events containing that text across searchable indexes.
  • Use index=testindex GET when the intended data source is known.
  • The result count is the number of matching events in the active time range, not necessarily the number of unique requests or values.
  • Use Timeline for event volume over time, Fields for extracted data elements, and Results for raw matching events.
  • Check the time range whenever results are absent or unexpected.
  • Use extracted fields and, later, Boolean expressions to make searches more focused.