Splunk Cloud

Search Reference

Download manual as PDF

Download topic as PDF

walklex

Description

Generates a list of terms or indexed fields from each bucket of event indexes. Only applies to warm buckets that have a merged lexicon file or single tsidx file.

Syntax

The required syntax is in bold.

| walklex
[ type=<walklex-type> ]
[ prefix=<string> | pattern=<wc-string> ]
<index-list>
[ splunk_server=<wc-string> ]
[ splunk_server_group=<wc-string> ]...


Required arguments

<index-list>
Syntax: index=<index-name> index=<index-name> ...
Description: Limits the search to one or more indexes. For example, index=_internal.

Optional arguments

prefix | pattern
Syntax: prefix=<string> | pattern=<wc-string>
Description: Limits results to terms that match a specific pattern or prefix. Either prefix or pattern can be specified but not both. Includes only buckets with a merged_lexicon file or a single tsidx file. This means that hot buckets are generally not included.
Default: pattern=*
splunk_server
Syntax: splunk_server=<wc-string>
Description: Specifies the distributed search peers from which to return results.
  • If you are using Splunk Cloud, omit this parameter.
  • If you are using Splunk Enterprise, you can specify only one splunk_server argument. However, you can use a wildcard when you specify the server name to indicate multiple servers. For example, you can specify splunk_server=peer01 or splunk_server=peer*. Use local to refer to the search head.
Default: All configured search peers return information


splunk_server_group
Syntax: splunk_server_group=<wc-string>
Description: Limits the results to one or more server groups. You can specify a wildcard character in the string to indicate multiple server groups with similar names. If you are using Splunk Cloud, omit this parameter.
Default: None
type
Syntax: type = ( all | field | fieldvalue | term )
Description: Specifies which type of terms to return in the lexicon. See Usage for more information about using the type argument options.
  • Use field to return only the unique field names in each index bucket.
  • Use fieldvalue to include only indexed field terms.
  • Use term to exclude all indexed field terms of the form "<field>::<value>".
Default: all

Usage

The walklex command is a generating command, which use a leading pipe character. The walklex command must be the first command in a search. See Command types.

When the Splunk software indexes data, it segments each event into raw tokens using rules specified in segmenters.conf file. You might end up with raw tokens that are actually key-value pairs separated by an arbitrary delimiter such as an equal ( = ) symbol.

The following search uses the walklex and where commands to find the raw tokens in your index. The stats command is used to count the raw tokens:

| walklex index=<target-index> | where NOT like(term, "%::%") | stats sum(count) by term

Using type=field

When the type=field argument is specified, the results returned will include only the field names from indexed fields. With the default settings, the Splunk software indexes the values for host, source, and sourcetype. In addition, the settings in the props.conf file can permit the creation of the date_* fields, the punct field, etc. Any additional fields, whether created by INDEXED_EXTRACTIONS or other "WRITE_META" methods, would also be returned. It is the discovery of this list of additional fields which is most likely to benefit you in accelerating your searches.

Using type=fieldvalue

The type=fieldvalue argument returns the list of terms from the index which are part of indexed fields and have indexed values. Unlike the type=field argument, where the values returned are only the field names themselves, the type=fieldvalue argumentt returns terms that have any field value for an indexed term.

For example, if the indexed field term is runtime::0.04, the value returned with the type=fieldvalue is runtime::0.04. The value returned by the type=field argument would be runtime.

Using type=term

When type-term is specified, the keywords from the TSIDX files which are not part of any indexed field structure are returned.

Using type=all

When no type is specified, the default type=all is used. The terms in the index of all three types field, fieldvalue, and term are returned.

When type=all is used, the indexed fields are not called out explicitly as the fields are with the type=field argument. You will need to split the term field on :: to obtain the field values from the indexed term.

Basic examples

1: Return the total count for each term in a specific bucket

The following example returns all of the terms in each bucket of the _internal index and finds the total count for each term.

| walklex index=_internal | stats sum(count) BY term

2: Specifying multiple indexes

The following example returns all of the terms that start with foo in each bucket of the _internal and _audit indexes.

| walklex prefix=foo index=_internal index=_audit


3. Use a pattern to locate indexed field terms

The following example returns all of the indexed field terms for each bucket that end with bar in the _internal index.

| walklex pattern=*bar type=fieldvalue index=_internal


4. Return all field names of indexed fields

The following example returns all of the field names of indexed fields in each bucket of the _audit index.

| walklex type=field index=_audit

See also

Commands
metadata
tstats
PREVIOUS
untable
  NEXT
where

This documentation applies to the following versions of Splunk Cloud: 8.0.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters