Splunk chuleta operativa
Splunk chuleta operativa
Splunk chuleta operativa
Este post sirve para lanzar busquedas Splunk, filtrar eventos, extraer campos y comprobar el estado del forwarder.
Busquedas basicas
1
2
3
index=<INDEX> sourcetype=<SOURCETYPE>
index=<INDEX> host=<HOSTNAME> ERROR
index=<INDEX> earliest=-1h latest=now
Campos y agregaciones
1
2
3
index=<INDEX> status>=500 | stats count by host, status
index=<INDEX> "<PATRON>" | timechart count by host
index=<INDEX> | top limit=20 source
Extraccion rapida
1
index=<INDEX> | rex field=_raw "usuario=(?<usuario>[^ ]+)" | stats count by usuario
Forwarder
1
2
3
/opt/splunkforwarder/bin/splunk status
/opt/splunkforwarder/bin/splunk restart
/opt/splunkforwarder/bin/splunk list forward-server
This post is licensed under CC BY 4.0 by the author.