Splunk online course

Run a Basic Search in Splunk

Learn how to search indexed Splunk events, restrict searches to an index, use fields and Boolean logic, and read the Search results page.

What an Event Search Does

Splunk is a platform for ingesting, indexing, searching, and analyzing machine-generated data. After data is added to Splunk and processed into indexed data, you can search it to find individual records that contain requested terms or match specified conditions.

An event is an individual record in Splunk. Events usually include a timestamp, source information, and the original event text. An event search is therefore the next step after ingestion: you use Splunk Search Processing Language, commonly called SPL, to locate and investigate the events you need.

Before starting, make sure data has been added to Splunk, you understand which indexes contain that data, and you know that results depend on the selected time range.

For background, see What Is Splunk, Add Data To Splunk, and What Is An Index.

Enter and Run a Search

Open the Splunk Search interface. The Search bar is the input where you enter SPL search criteria. Select an appropriate time range, enter a query, and run it by pressing Enter or selecting the Search button, depending on the Splunk interface version.

A simple word or phrase is a free-text search. For example:

GET

This search asks Splunk to return events containing the term GET within the indexes and time range you can search. It is a broad search: the term might appear in raw event text or in searchable event content from many sources.

Search Within a Specific Index

An index is a logical data store that organizes Splunk events. Indexes often separate data by purpose, environment, application, or source. Add an index= condition to limit a search to one index.

index=testindex GET

This query searches for GET only in the testindex index. Restricting the index improves relevance by excluding unrelated data stores and can reduce the amount of data Splunk must examine. By contrast, a keyword-only search can search across all accessible indexed data within the selected time range.

The total shown for the matching events represents records that satisfy the entered criteria, subject to the active time range and your permissions. It is not necessarily the total number of events stored in the index.

Read the Search Results Page

After a search runs, the Search results page presents visual summaries and individual events. The exact arrangement can vary by Splunk version, but three areas are especially useful: the timeline, the Fields panel, and the Results area.

Timeline

The timeline distributes matching events across the active time range. A tall section or spike means many matching events occurred during that period. A gap means few or no matching events were found then. Use these patterns to identify when activity increased, stopped, or changed.

Fields Panel

A field is a named attribute extracted from an event, such as host, source, status, or method. The Fields panel lists fields Splunk recognizes in the returned events and may show values associated with them. A field might be present in only some events.

Discovered fields help you move from broad text matching to structured filtering. For example, after finding HTTP-related events, you can focus on responses with a particular status:

index=testindex GET status=404

This query requires the event to match the index, contain GET, and have the field condition status=404. Field-based filtering is more precise than merely searching for the text 404, because it asks Splunk to evaluate the named attribute and its value.

For more on fields, see Fields.

Results Area

The Results area lists the individual events that match the search. Each event includes a timestamp showing when Splunk associates the event with a point in time. Results are ordered by event time, typically with the newest events first. Always check the timestamp when comparing events or explaining the sequence of activity.

Refine Searches with Boolean Logic

A Boolean expression combines search conditions with operators. AND requires conditions to be true together, OR accepts either alternative, and NOT excludes events containing a condition.

Parentheses are important when a search includes more than one logical operation. They show which conditions belong together and prevent an OR alternative from being interpreted more broadly than intended.

For example, compare these investigation steps:

1. Start with a broad keyword: GET.

2. Restrict the data store: index=testindex GET.

3. Require an additional indicator: index=testindex GET AND error.

4. Choose among alternatives with grouping: index=testindex (GET OR POST).

5. Remove routine checks: index=testindex GET NOT healthcheck.

Boolean logic combines with index scoping: the index=testindex condition limits the data first, while the remaining terms describe which events to include or exclude.

See Boolean Expressions and Search Rules for related syntax guidance.

Practical Search Workflow

1. Choose a time range that includes the activity you want to investigate. The Time Range Picker controls which event times are considered.

2. Run a broad keyword search, such as GET, if you are still locating the data.

3. Inspect the timeline for periods of activity and gaps.

4. Review the Fields panel for useful attributes and values.

5. Add an index condition, such as index=testindex, when you know the correct data store.

6. Add field conditions or Boolean operators to focus on the events relevant to your question.

7. Read individual Results and verify their timestamps before drawing conclusions.

Troubleshooting Basic Searches

No Events Are Returned

• Expand the selected time range; the relevant timestamps might be outside it.

• Verify the index name. The events might have been sent to a different index.

• Start with a broader query to check whether the search term appears in the indexed event text.

• Confirm that your role has permission to search the target index.

Too Many Unrelated Results

• Add an index constraint to remove unrelated data stores.

• Use extracted fields such as host, source, status, or method.

• Add required terms with AND or exclude routine matches with NOT.

An Expected Field Is Missing

• Inspect the raw matching events; the selected events might not contain that value.

• Search for a known value directly to determine whether it is present in the event text.

• Check field extraction or parsing if structured fields are required.

Boolean Results Seem Unexpected

• Put alternative conditions in parentheses, especially when combining OR with AND.

• Run each condition separately before combining them.

• Build the query incrementally and compare result totals after each change.

• Check whether a NOT condition excludes more events than intended.

Key Points

• Search indexed data after ingestion to locate events matching terms or conditions.

• Enter SPL in the Search bar and run it with Enter or the Search control.

• Use index=name to limit the search scope and improve relevance.

• Use the timeline to understand event volume over time, the Fields panel to discover attributes, and Results to inspect individual events.

• Move from broad text matching to field/value filters for more precise investigations.

• Use AND, OR, and NOT carefully, grouping alternatives with parentheses.