Documentation > Splunk > Application Management > Pinpoint a problem using time

Application Management

 


Application Management with Splunk
Index Data
Application Management Use Cases
Walkthrough: Index Data
Walkthrough: Troubleshoot using ID and Time
Walkthrough: Group Events into Transactions
Walkthrough: Monitor Transaction Performance
Walkthrough: Create a Business Dashboard

Pinpoint a problem using time

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Pinpoint a problem using time

Once you have found the exact time of a problem, you can change your search to look at all the events that happened immediately beforehand to locate your error.

1. To investigate this event further, click the time at the left of the event. The time picker automatically changes to Custom and Splunk restricts the search to the minute in which the event occurred. This is one of many ways you can use the UI to change the contents of your search. See Search interactively with Splunk Web in the User manual for more tips.

AppManageClickTime.png

2. Now expand your search to include all events that happened in that minute, not just events with the user's account number. Go to the search bar, delete the ID string, and press Enter to run the search index=test on this restricted time frame.

AppManageRemoveID.png

3. Scroll through the results for this time frame. If you need to expand or contract the time range, click Zoom out or Zoom in above the timeline. In this case, you can see a whole slew of database errors. Looks like the database ran out of space (again).

AppManageTroubleshootDB.png

Note that you found the root cause directly, using just the accountNumber. You don't need fields or keys or any database structure here to get something that is useful right out of the box.

Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.1.4/AppManagement/Pinpointaproblemusingtime"

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!