Related Answers
Download topic as PDF
metasearch
Description
Retrieves event metadata from indexes based on terms in the <logical-expression>.
Syntax
metasearch [<logical-expression>]
Optional arguments
- <logical-expression>
- Syntax: <time-opts> | <search-modifier> | [NOT] <logical-expression> | <index-expression> | <comparison-expression> | <logical-expression> [OR <logical-expression>]
- Description: Includes time and search modifiers, comparison and index expressions.
Logical expression
- <comparison-expression>
- Syntax: <field><cmp><value>
- Description: Compare a field to a literal value or values of another field.
- <index-expression>
- Syntax: "<string>" | <term> | <search-modifier>
- <time-opts>
- Syntax: [<timeformat>] [<time-modifier>]...
Comparison expression
- <cmp>
- Syntax: = | != | < | <= | > | >=
- Description: Comparison operators.
- <field>
- Syntax: <string>
- Description: The name of one of the fields returned by the
metasearchcommand. See Usage.
- <lit-value>
- Syntax: <string> | <num>
- Description: An exact, or literal, value of a field that is used in a comparison expression.
- <value>
- Syntax: <lit-value> | <field>
- Description: In comparison-expressions, the literal value of a field or another field name. The <lit-value> must be a number or a string.
Index expression
- <search-modifier>
- Syntax: <field-specifier> | <savedsplunk-specifier> | <tag-specifier>
Time options
The search allows many flexible options for searching based on time. For a list of time modifiers, see the topic Time modifiers for search in the Search Manual.
- <timeformat>
- Syntax: timeformat=<string>
- Description: Set the time format for starttime and endtime terms. By default, timestamp is formatted:
timeformat=%m/%d/%Y:%H:%M:%S.
- <time-modifier>
- Syntax: earliest=<time_modifier> | latest=<time_modifier>
- Description: Specify start and end times using relative or absolute time. For more about the time modifier index, see Specify time modifiers in your search in the Search Manual.
Usage
The metasearch command is an event-generating command. See Command types.
Generating commands use a leading pipe character and should be the first command in a search.
The metasearch command returns these fields:
| Field | Description |
|---|---|
| host | A default field that contains the host name or IP address of the network device that generated an event. |
| index | The repository for data. When the Splunk platform indexes raw data, it transforms the data into searchable events. |
| source | A default field that identifies the source of an event, that is, where the event originated. |
| sourcetype | A default field that identifies the data structure of an event. |
| splunk_server | The name of the instance where Splunk Enterprise is installed. |
| _time | The _time field contains an event's timestamp expressed in UNIX time. |
Examples
Example 1:
Return metadata on the default index for events with "404" and from host "webserver1".
| metasearch 404 host="webserver1"
See also
|
PREVIOUS metadata |
NEXT multikv |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.9, 6.6.8, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.5, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.2.0, 7.0.4, 7.0.6, 7.0.7, 7.0.8
Feedback submitted, thanks!