Related Answers
Download topic as PDF
Step 7: Try a simple data search
Let's try a simple search of our test data.
1. Click on the Search link for your new Virtual Index.
2. Take a look at the data in "ponyindex."
3. Try the following simple search:
- index=ponyindex | rex field=source "/data/(?<file_name>[^/]+)$" | stats count values(sourcetype) as sourcetype values(tasktracker) as tasktracker by host file_name
4. For time range, select "All time". If you do want to use time ranges in your eventual deployment, note that time-dependent search commands work differently (and occasionally not at all) on HDFS directories. For more information, see Search a virtual index.
5. Run your report. In the next step we will save this report and share it with other users.
|
PREVIOUS Step 6: Set up a Virtual Index |
NEXT Step 8: Search using a sourcetype |
This documentation applies to the following versions of Hunk®(Legacy): 6.0, 6.0.1, 6.0.2, 6.0.3, 6.1, 6.1.1, 6.1.2, 6.1.3, 6.2, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11
Feedback submitted, thanks!