The search command is used to search events and filter the result from the indexes. The search command, followed by keywords, phrases, regular expressions, wildcards, and key-value pairs, can be used to fetch filtered events from the indexes.

Mentioned as follows is the syntax for a search command instance:

<keywords>
    <wildcards>
    <key_value_pairs> or <fields>
    <phrases>
    <operators>
    <logical_expressions>
    <regular_expressions>
    <time_specifiers>

The parameter description for the preceding parameters is as follows:

The following are examples of a search operation with two different scenarios:

index=web_server error 404
index=web_server IP=192.168.* AND IP=10.20.* | search "login failed" OR "incorrect password"

In the first example, all the events that have an error and 404 will be shown in the search result. Here, we have used the keyword (error and 404) to be searched in the index. In the second example, the query will result in all the events that have IP (192.168.* and 10.20.*). We have used the AND Boolean operator along with wildcard (*) for the IP address to filter the required result. In the later section of the second example, after pipe (|) phrases in quotes (login failed and incorrect password) are used along with the Boolean operator OR to get all the events that have either failed to log in or used an incorrect password.

The sendmail command is used to send the search result over e-mail. The search results can be sent inline in the e-mail or as a PDF attachment. This command can be used in the scripts or while scheduling reports to run search queries with the specified filters and keywords. Then, the results are to be e-mailed to the specified recipient(s).

The syntax for the sendemail command is as follows:

sendemail to=<email_id(s)>
        from=<email_id(s)>
        cc=<email_id(s)>
        bcc=<email_id(s)>
        subject=<enter_subject_for_email>
        format=csv/ raw / table
        inline= true/false
        sendpdf=true/false
        
server=<email_server>

The parameter description of the sendemail command is as follows:

Refer to the following example for a better understanding:

index=_internal error | head 10 | [email protected] [email protected] subject="Top 10 errors of this hour" sendpdf=true inline=true format=raw

The preceding search query will send an e-mail to <[email protected]>, which will be Cced to <[email protected]> with the subject Top 10 errors of this hour having a PDF attachment (sendpdf=true). The PDF will contain the top 10 errors of the _internal index events in the raw (format=raw) format, and this information will also be available inline (inline=true) in the e-mail.

Splunk is generally deployed in a distributed architecture, and it can have many indexers and search heads in a real deployment environment. Whenever a search is run on a search head, the results are fetched from all the indexers of the distributed architecture. If the user wants to run the search on only local indexers and does not require data from all the other remote indexes, then the localop command can be used.

The syntax for the localop command is as follows:

|localop

Refer to the following example for better lucidity:

Index=web_server error |localop | userIP

The preceding search query will return userIP only from the local indexer and error from the local as well as remote indexers of Index=web_server.