Splunk® Enterprise

Search Manual

Download manual as PDF

Download topic as PDF

Search command primer

At the beginning of a search pipeline, the search command is implied, even though you do not explicitly specify it. If you type in

host=webserver*

It is as if you typed in

search host=webserver*

Use keywords, phrases, fields, boolean expressions, and comparison expressions to specify exactly which events you want to retrieve from Splunk indexes.

For specific information see:

Keywords and phrases

By default, when you search with keywords and phrases, Splunk software retrieves events by matching against the raw event field, _raw, in your data. When you start adding search modifiers, such as fields like _time and tag, you are also matching against pieces of information that have been extracted from the _raw field.

When searching for strings, which includes keywords and quoted phrases (or anything that's not a search modifier), Splunk software searches the _raw field for the matching events or results. Some examples of keywords and phrases are:

web

error

web error

"web error"

Note that the search for the quoted phrase "web error" is not the same as the search before it. When you search for web error, Splunk software returns events that contain both "web" and "error". When you search for "web error", Splunk software only returns events that contain the phrase "web error".

See Also

PREVIOUS
Search history
  NEXT
Wildcards

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.6.0, 6.6.1, 6.6.2, 6.6.3


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters