Security

How to search the _internal index for banner error messages that appear on the Splunk Web UI?

crodri210
Explorer

How do you search for banner messages that appear on the Splunk Web Interface. I'm looking for error messages like "Unable to distribute to peer name XXXXX at uri xx.xx.xx.xxx:xxx because peer status = "Down"

I tried running index=_internal source="*web_service.log" raise from a previous post (http://answers.splunk.com/answers/81552/how-to-search-for-all-banner-messages.html), but this doesn't give me the information that I'm looking for.

1 Solution

crodri210
Explorer

I think I got it. I just ran the following search and it gave me the information I was looking for

index=_internal "Unable to distribute"

View solution in original post

rdowd
Path Finder

I found this which closely matches your question.

 | rest /services/messages | table title message severity timeCreated_iso published splunk_server author 

I then created an alert from this..

crodri210
Explorer

I think I got it. I just ran the following search and it gave me the information I was looking for

index=_internal "Unable to distribute"

somesoni2
SplunkTrust
SplunkTrust

I guess All the error/warning messages from Splunk Web UI are stored as Splunk's internal error. May like this will give you all the errors/warnings. Of course, you can search for specific warnings.

index=_internal sourcetype=splunkd log_level="WARN" OR log_level="ERROR" 

crodri210
Explorer

Cool thanks somesoni2!

0 Karma

NOUMSSI
Builder

Hi,
The answer of somesoni2 is good but i just want to extend his answer. Because there many values of field "log_level" use this query:
index=_internal sourcetype=splunkd log_level=*

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...