Splunk Search

Can't search

wiz561
Explorer

I am just getting started with Splunk at home on Ubuntu. I'm gathering logs from my pfsense firewall and I can see that there are indexed events. When trying to search for something, the search box gets disabled and a little "do not enter" or "no" sign shows up where the cursor is. No results are returned.

I'm just typing in host="10.0.110.1" in the search field.

I'm assuming that there isn't something running that needs to be. I did switch the license from enterprise trial to the free 500meg/day license.

Tags (2)
0 Karma

amiracle
Splunk Employee
Splunk Employee

Did you add the os index and any other custom index to the Search Index by default. In the Web UI (Settings -> Access Controls -> Roles -> Admin -> scroll down to 'Indexes searched by default' and add the indexes you want to search by default. I hope that helps.

0 Karma

woodcock
Esteemed Legend

See what Splunk is complaining about with this search:

index=_internal source=*splunkd.log* log_level!=info | cluster showcount=t | table cluster_count _raw | sort -cluster_count
0 Karma

wiz561
Explorer

Thanks for the response. I think the problem lies deeper than this. I installed the *nix app and can sucessfully gather information from the local box. Even though Splunk says it is receiving information, I don't think it's making it searchable for some reason.

0 Karma

woodcock
Esteemed Legend

You (probably) need to specify an index; try this:

index=* OR index=_* host="10.0.110.1"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...