Skip to content

Using Splunk

Searching Logs

Start with the correct regional instance, expected index, narrow time range, and one stable identifier:

index=<expected_index> earliest=-30m device_name="<device_name>"

Inspect a recent event to confirm the available fields, then add customer, region, device type, or node type filters.

Saved Searches

Use saved searches that are owned and documented by the WxCDI team. Before saving a new search, remove real customer/device values, document its intended indexes and sourcetypes, and test it against more than one region.

Creating Reports

Reports should state their data source, time interpretation, filters, grouping, owner, and known coverage limits. Avoid expensive all-time searches and broad wildcard parsing.

Useful SPL Queries

Find whether a source has gone quiet:

index=<expected_index> earliest=-24h device_name="<device_name>"
| stats count min(_time) as first_seen max(_time) as last_seen by host, device_name, device_type
| convert ctime(first_seen) ctime(last_seen)

Inspect unenriched syslog:

index=unknown_syslog earliest=-60m
| stats count max(_time) as last_seen by host, source
| convert ctime(last_seen)
| sort - count

Tips & Tricks

  • Filter by index and time before parsing or joining.
  • Do not start with “All Time.”
  • An empty result does not prove that no event happened; validate source forwarding and ingress health.
  • Redact customer-sensitive payloads before sharing outside approved systems.