Documentation > Splunk > Search Reference > search

Search Reference

 


Welcome
Search Overview
Search Commands
Custom Search Commands

search

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

search

Synopsis

Retrieves events from an index and filters them using keywords or key/value expressions.

Syntax

... | search [<index-specifier>]? [<logical-expression>]?

Arguments

<index-specifier>
Syntax: index=<string>
Description: Search the specified index instead of the default index.
<logical-expression>
Syntax: <time-opts>|<search-modifier>|((NOT)? <logical-expression>)|<index-expression>|<comparison-expression>|(<logical-expression> (OR)? <logical-expression>)
Description: Includes time and search modifiers; comparison and index expressions.

Logical expression

<comparison-expression>
Syntax: <field><cmp><value>
Description: Compare a field to a literal value or values of another field.
<index-expression>
Syntax: "<string>"|<term>|<search-modifier>
<time-opts>
Syntax: (<timeformat>)? (<time-modifier>)*

Comparison expression

<cmp>
Syntax: = | != | < | <= | > | >=
Description: Comparison operators.
<field>
Syntax: <string>
Description: The name of a field.
<lit-value>
Syntax: <string> | <num>
Description: An exact, or literal, value of a field; used in a comparison expression.
<value>
Syntax: <lit-value> | <field>
Description: In comparison-expressions, the literal (number or string) value of a field or another field name.

Index expression

<search-modifier>
Syntax: <field-specifier>|<savedsplunk-specifier>|<tag-specifier>

Time options

<timeformat>
Syntax: timeformat=<string>
Description: Set the time format for starttime and endtime terms.
<time-modifier>
Syntax: <earliest> | <latest>
Description: Specify start and end times.

Examples

Example 1: Keep only search results that have the specified "src" or "dst" values.

src="10.9.165.*" OR dst="10.9.165.8"

Example 2: Search for events with either codes 10 or 29, and a host that isn't "localhost" and an xqp that is greater than 5

(code=10 OR code=29) host!="localhost" xqp>5

Example 3: Search for events with "404" and from host "webserver1"

404 host="webserver1"
Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.0.3/SearchReference/Search"

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!