Skip to main content

Searching Logs

🔍 Log Search Interface Overview :​

⭐ Steps for Using the Logs Search ⭐​

  1. Select or Enter Queries:

    • You can either select a query from the info icon or enter your own.

      Query Search

  2. Choose Query Type:

    • Select which type of query you want to search: SQL, Splunk QL, LogQL.

      log-query Type

  3. Select Index:

    • Choose an index from the index dropdown.

      log-index

  4. Set Time Range:

    • Select the time range for the query.

      log-time-range

      ⭐ SQL Query Examples ⭐​

      SELECT first_name AS firstnames, country AS origincountry FROM `ind-0`

      sql-1

      SELECT * FROM `ind-0` ORDER BY latency ASC

      sql-2

      SELECT MAX(latency), COUNT(city) FROM `*` GROUP BY country, gender LIMIT 10

      sql-3

      SELECT min(latency), COUNT(city) FROM `*` WHERE gender = male GROUP BY country LIMIT 10

      sql-4

      select 1 as one,'word' as word,city from `ind-0`

      sql-5

      ⭐ Splunk QL Query Examples ⭐​

      city=Boston | stats count AS Count BY weekday | where Count / 2 > 6 OR weekday = "Saturday"

      spl-1

      http_method=POST | regex city="^[a-zA-Z]+\s[a-zA-Z]+$" | fields city

      spl-2

      city=Boston | stats count AS Count BY state | eval myField=state . " start:" . rtrim(state, "nd")

      spl-3

      city=Boston | stats count AS Count BY state | eval myField=if(in(state, "Mary" . "land", "Hawaii", 99 + 1), state, "Error")

      spl-4

      city=Columbus | stats count AS Count BY http_status | eval sqrt=sqrt(http_status + 200)

      spl-5

      ⭐ Log QL Query Examples ⭐​

      {gender="female",city="Fresno"} != "batch-212"

      logql-1

      {gender="female"} | json

      logql-2

      {gender="female"} | logfmt

      logql-3

      {gender="female",city="Fresno"} | json city_life="city", single_gender="gender[0]"

      logql-4

      {gender="female",city="Fresno"} | logfmt city_life="city", single_gender="gender", host

      logql-5