Splunk® Cloud Services

SPL2 Search Manual

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

Searching datasets

Searching a dataset is easy.

Use the from command to read data located in any kind of dataset, such as a timestamped index, a metric index, a view, or a lookup. The only required syntax is:

| from <dataset-name>

This simple search returns all of the data in the dataset. That might be a lot of data. You should try to narrow down the results returned from the dataset by adding filters to your search. You can use filters to specify what you are looking for or what you want to exclude from your data.

To show you how this works, let's start with an event index called main, which is your dataset. The main index contains events with HTTP status codes. You want to find all of the events with a status code of 200.

You can search the main index using a simple search like this:

| from main where status=200

This search returns events that have the value 200 in the status field.

Specifying field-value pairs in the where clause is one way to filter data. Identifying a time-range that you want to search is another way to filter your search results.

Specifying field-value pairs

When you specify a field-value pair, if the value is a <string> it must be enclosed in double quotation marks. For example, the following search looks for a specific value webserver1 in the host field. The value must be enclosed in double quotation marks.

| from main where host="webserver1"


Likewise, numbers that are interpreted as string values must also be enclosed in double quotation marks. For example:

| from main where client_ip="192.0.2.0"


Field names that contain characters other than a-z, A-Z, 0-9, or the underscore ( _ ) character must be enclosed in single quotation marks. For example, the field in this search contains a dash ( - ) and must be in single quotations marks:

| from main where 'client-ip'="192.0.2.0"


TIP: Not sure which numbers need to be quoted? Ask yourself if you would ever create a SUM of the numbers. For numbers like IP addresses or HTTP codes, although they are numbers, a SUM of IP addresses or HTTP codes makes no sense. These types of numbers should be treated as <string> values and enclosed in double quotation marks.

Next step

See Searching specific time ranges.

Last modified on 23 April, 2020
PREVIOUS
What's a dataset?
  NEXT
Searching specific time ranges

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters