Documentation
Use the Locate Data app when you do not know which data sources contain the data that you are interested in, or to see what data your Indexes, Source types, Sources, and Hosts contain. The Locate Data app provides tools to organize your search results, such as custom groupings of fields and summary information.
Open Locate Data
Open Locate Data by selecting the Locate Data app from the left navigation bar. You may need to restart Splunk to see the app.
The Locate Data search fields
- Keyword
- Type one or more keywords separated by a space. You can leave this field blank to search for all fields
- Time Range
- Filter the events to search within a time range. Defaults to the last 24 hours
- Index
- Filters your events to search within the specified indexes. Click the input field to enter an index name, or select one from the list that appears. You can select more than one index. This field accepts wildcards.
- Host
- Filters your events to search with the specified hosts. Click the input field to enter a host name, or select one from the list that appears. You can select more than one host. This field accepts wildcards.
- Source
- Filters your events to search with the specified sources. Click the input field to enter a source name, or select one from the list that appears. You can select more than one source.
- Source type
- Filters your events to search with the specified source types. Click the input field to enter a source type name, or select one from the list that appears. You can select more than one source type.
- Split By
- Specifies a field to split the results by. You can split by Index, Source type, Host, or Source fields. You must split by one field. The more fields that are selected, the more expensive the search.
- Split By Order
- Chooses the order for the Split By fields. This order determines the resulted table column order.
- Sort Order
- Determines how the results table is sorted. You can use custom or default time ranges.
- Generated Search Criteria
- Displays the SPL generated from your inputs. You can click Open in Search to open a search page in a new tab with the generated SPL.The SPL updates whenever you change an input. This may not be in sync with your table results.
Using Locate Data
Use Locate Data to explore and identify your data sources before you create a search.
Steps
- Select the Locate Data app from the left navigation bar.
- Type one or more keywords to search for in the keyword search bar.
- Click Show options to see additional filtering options.
- (Optional) Filter the keyword search by data source.
- (Optional) Use the time range picker to expand or narrow your search. The default time range is 24 hours.
- (Optional) Click Show generated search criteria to see the underlying Splunk Processing Language (SPL) that will run.
- (Optional) Select one or more fields to split your results by.
- Choose the split by and sort order by dragging the fields into the order that you prefer.
- Click Locate.
After you click the Locate button, Locate Data runs a search using the generated tstats SPL and provides a summary of events located in your data sources.
Explore your results
Once you have located your data, expand a row to further drill down on your data. After locating your data, scroll through the list of indexes in your search results.
Steps
- The Split By field determines which columns are returned. If index and source are selected, you are able to view which index your data is in, the source type for the data, and a count of how many events are matched to your search. Rows in the table are ordered by the Sort Order field.
- Expand a row to view the Timeline, Top Fields, and Sample Events for your keyword. A full search on the selected row will run. The timeline displays up to 2000 events. There is a column for each field specified in the Split By field.
- Click Open in Search to open the data in the Search and Reporting app. A new search page opens with the data from the SPL generated from the row.
Release Notes
Release notes for Locate Data, Version 1.2.
