Searching a dataset is easy.
from command to read data located in any kind of dataset, such as a timestamped index, a metric index, a view, or a lookup. The only required syntax is:
| from <dataset-name>
This simple search returns all of the data in the dataset. That might be a lot of data. You should try to narrow down the results returned from the dataset by adding filters to your search. You can use filters to specify what you are looking for or what you want to exclude from your data.
To show you how this works, let's start with an event index called
main, which is your dataset. The
main index contains events with HTTP status codes. You want to find all of the events with a status code of 200.
You can search the
main index using a simple search like this:
| from main where status=200
This search returns events that have the value 200 in the
Specifying field-value pairs in the
where clause is one way to filter data. Identifying a time-range that you want to search is another way to filter your search results.
Specifying field-value pairs
When you specify a field-value pair, if the value is a <string> it must be enclosed in double quotation marks. For example, the following search looks for a specific value
webserver1 in the host field. The value must be enclosed in double quotation marks.
| from main where host="webserver1"
Likewise, numbers that are interpreted as string values must also be enclosed in double quotation marks. For example:
| from main where client_ip="192.0.2.0"
Field names that contain characters other than a-z, A-Z, 0-9, or the underscore ( _ ) character must be enclosed in single quotation marks. For example, the field in this search contains a dash ( - ) and must be in single quotations marks:
| from main where 'client-ip'="192.0.2.0"
TIP: Not sure which numbers need to be quoted? Ask yourself if you would ever create a SUM of the numbers. For numbers like IP addresses or HTTP codes, although they are numbers, a SUM of IP addresses or HTTP codes makes no sense. These types of numbers should be treated as <string> values and enclosed in double quotation marks.
What's a dataset?
Searching specific time ranges
This documentation applies to the following versions of Splunk® Cloud Services: current