O'Reilly logo

Implementing Splunk: Big Data Reporting and Development for Operational Intelligence by Vincent Bumgarner

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Making searches faster

We have talked about using the index to make searches faster. When starting a new investigation, following a few steps will help you get results faster:

  1. Set the time to the minimum time that you believe will be required to locate relevant events. For a chatty log, this may be as little as a minute. If you don't know when the events occurred, you might search a larger time frame and then zoom in by clicking on the timeline while the search is running.
  2. Specify the index if you have multiple indexes. It's good to get into the habit of starting your queries with the index name, for example, index=myapplicationindex error bob.
  3. Specify other fields that are relevant. The most common fields to specify are sourcetype and host, for ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required