topic How to ignore internal indexes when searching? in Getting Data In

How to ignore internal indexes when searching?

splunkreal — Tue, 29 Sep 2020 11:08:36 GMT

Hello,

| rest /services/data/indexes-extended | eval bd_home_event_min_time=strftime('bucket_dirs.home.event_min_time',"%d/%m/%Y") | eval bd_home_event_max_time=strftime('bucket_dirs.home.event_max_time',"%d/%m/%Y") | eval bd_cold_event_min_time=strftime('bucket_dirs.cold.event_min_time',"%d/%m/%Y") | eval bd_cold_event_max_time=strftime('bucket_dirs.cold.event_max_time',"%d/%m/%Y") | table title,bd_home_event_min_time,bd_home_event_max_time,bd_cold_event_min_time,bd_cold_event_max_time,splunk_server | sort title | where not like(title,"_%")

returns empty result.

However the where clause works if I don't use underscore.

My aim is to ignore internal indexes.

Thanks for your help.

Re: How to ignore internal indexes when searching?

dmaislin_splunk — Fri, 23 Sep 2016 14:45:16 GMT

| rest /services/data/indexes-extended | eval bd_home_event_min_time=strftime('bucket_dirs.home.event_min_time',"%d/%m/%Y") | eval bd_home_event_max_time=strftime('bucket_dirs.home.event_max_time',"%d/%m/%Y") | eval bd_cold_event_min_time=strftime('bucket_dirs.cold.event_min_time',"%d/%m/%Y") | eval bd_cold_event_max_time=strftime('bucket_dirs.cold.event_max_time',"%d/%m/%Y") | table title,bd_home_event_min_time,bd_home_event_max_time,bd_cold_event_min_time,bd_cold_event_max_time,splunk_server | sort title | search title!="_*"

Re: How to ignore internal indexes when searching?

splunkreal — Fri, 23 Sep 2016 15:00:05 GMT

Thanks!

By the way what is the difference between * and % (to use wildcard) ?

Re: How to ignore internal indexes when searching?

sduchene_splunk — Thu, 19 Jan 2017 08:06:33 GMT

and % are 2 different things : % are used for date formatting, see https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables

% is not a wildcard.
for wildcard see : https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Wildcards