Do we able to search string from different index which resides accross different client (Splunk forwarder) ?

[sambed]

Let us think a scenario , where from different system having installed with Splunk forwarder connect to same SPLUNK server .So can we get the search option for a particular event (search string) which may occurs in in each different systems or client .

[sambed]

Thank You Cusello and Rich .
Your info is very helpful.

[richgalloway]

If your problem is resolved, please accept an answer.

[gcusello]

Hi sambed,
on Forwarders there aren't indexed logs, they are only in Splunk Enterprise.
So if you want only logs from a single Forwarder, you can run a search with the host value, something like this:

index=your_index host=your_forwarder

Bye.
Giuseppe

[Richfez]

Sure. Simplest:

index=* "My Search String"

Not necessarily recommended unless you have a good idea what you are doing because it'll search ALL data for that string - but it'll work fine enough.

Once you get results, you can use the Interesting Fields on the left to find out indexes and sourcetypes you need so that you can make the above search more specific (and thus faster). Like

index=Z OR index=X OR index=Y EventCode=4226 

Which would search in any of index X, Y or Z for a field named "EventCode" which is set to 4226.

I recommend taking a look at the search tutorial in Splunk docs. You may also want to check out the Basic Searching in Splunk free course.