Splunk 7.x Quick Start Guide

Index

The first and most basic search command that you can execute is to specify an index. Unless you are looking for events containing a particular text string and you have no idea what index or sourcetype those events might be found in, you should always specify an index at the beginning of your search string to avoid searching the entire set of indexes, which is terribly wasteful.

Splunk has internal indexes, such as _internal, _introspection, and _audit, that contain events from the internal, which are kept in $SPLUNK_HOME/var/log /introspection and $SPLUNK_HOME/var/log/splunk. By default, you must have admin privileges to view the events in these indexes.

Then there are the custom indexes that are created by various Splunk apps and the ...