Best practices with search anatomy
There are three basic components of search anatomy. You will have a better working knowledge of search query syntax after reading the following information.
The root search
Always make sure to list as many metadata fields as you can in this section because that will speed up your search results. If you just put a host=host2 call in this part of the search, Splunk will scrub every index, every sourcetype, and every source within your selected time-range for that host, which takes a lot longer than if you specify the data location you want. The proper use of this portion usually looks something like this:
index=MyIndex sourcetype=iisLogs source=".../inetpub/*.log" host=host1 OR host=host2
This small action can reduce ...
Get Splunk Best Practices now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
