Splunk online course

Open the Search & Reporting App in Splunk

Learn how to open Splunk's Search & Reporting app, understand its main controls, choose a time range, and prepare your first search.

Overview

The Search & Reporting app is Splunk's primary interface for exploring indexed events. Indexed events are data records that Splunk has processed and stored so they can be searched.

Launching this app is the step after data has been added or indexed and before you write and run searches. From the app, you can search event data and work with reports, alerts, dashboards, and pivots.

This lesson assumes that you can sign in to Splunk and have already added data. If you need to prepare data first, see Add Data to Splunk and What Is An Index.

Launch the Search & Reporting app

1. Begin at Splunk Home or the app-selection area.
2. Locate the app icons or app navigation.
3. Select the Search & Reporting icon or app entry.
4. Wait for the app's default search-oriented landing page to open.

The destination is the Search summary view, the initial search-focused page displayed after opening the app. It provides the controls and context needed to begin searching.

What the initial Search summary view contains

The landing page combines several areas in one place: navigation to other app functions, search input, time selection, information about available data, help resources, and searches previously run by your user.

Use the app bar to change views

The app bar is the navigation area for moving among the main views of Search & Reporting.

Use Search when you want to investigate a question immediately. Use the other views when you are working with saved or visualized search results.

Enter and run a search

The search bar is the field where you enter a search expression. For this introductory step, enter a simple expression or sample keyword that should occur in the indexed data.

1. Choose an appropriate time range with the time range picker.
2. Click in the search bar and enter a search string.
3. Press Enter, or select the search or spyglass control.
4. Wait for Splunk to display the search results.

The selected time range affects which events Splunk considers. A correct search can appear to return no results when its time window does not include the relevant events.

Detailed Search Processing Language instruction is outside the scope of this launch lesson. For the next step, study Splunk Search Rules or review an Example Search.

Choose a time range

The time range picker is located near the search controls. It limits a search to events within the selected period, such as the last few minutes, the last day, or a custom interval.

When data was recently ingested, select a window that includes the ingestion time and the event time represented by the data. If the range is unexpectedly narrow, events outside it will not be considered.

For more guidance on this control, see Time Range Picker.

Find guidance and data context

How to search

The help-oriented How to search panel directs new users to built-in learning resources, including the Search Tutorial and Search Manual.

• The Search Tutorial provides learning material for practicing Splunk search capabilities.
• The Search Manual provides reference information for Splunk search features.
• Use these resources when you know that data exists but need help forming or refining a search.

You can also use the Splunk Online Tutorial as a structured learning resource.

What to search

The data-oriented What to search panel summarizes data available on the Splunk instance. Review it to determine what kinds of indexed data may be available before deciding what to search for.

These two panels answer different beginner questions: How do I search? is answered by the learning resources, while What can I search? is answered by the available-data summary.

Use search history

Search history is a record of searches previously performed by the current user. It is useful when you want to:

• Revisit an earlier query.
• Rerun a search against a new time range.
• Learn from a query that already produced useful results.

If a query is missing, open the search history area and confirm that the query was actually run previously under the current user context.

Practical walkthrough

Opening the interface after adding data

1. Sign in to Splunk and open Splunk Home or the app-selection area.
2. Select Search & Reporting.
3. Confirm that the Search summary view opens.
4. Identify the app bar, search field, time selector, help panel, data summary panel, and search history.

Preparing an ad hoc search

1. Choose a time window that includes the recently ingested data.
2. Enter a simple search expression or sample keyword in the search bar.
3. Press Enter or select the search icon.
4. Review the returned results. Detailed result interpretation belongs in the next search lesson.

Finding learning and data context

1. Open the How to search panel to find the Search Tutorial or Search Manual.
2. Review the What to search panel to identify data available on the instance.
3. Open Search history to revisit an earlier query.

Troubleshooting

The expected search page does not appear

• Verify that you selected Search & Reporting, not a different Splunk app.
• Confirm that your user account has access to the app in the current Splunk deployment.

A search returns no expected events

• Review the selected time range. The relevant events may fall outside the current window.
• Confirm that data was added and indexed before you attempted the search.
• Verify the entered search text before moving on to advanced search troubleshooting.

A previous query cannot be found

• Open the Search history area.
• Confirm that the query was actually executed previously.
• Check that you are using the same user context that ran the original search.

Next step

After opening Search & Reporting, select a suitable time range, enter a query, and execute it with Enter or the search control. Continue with Search Rules to learn how to construct and refine Splunk searches.