topic Search for percent symbol in log entries in Splunk Search

Search for percent symbol in log entries

castle1126 — Wed, 15 Sep 2010 00:19:07 GMT

Our web server logs have percent symbols in the entries. I am able to search for certain logs by using REGEX (e.g. REGEX _raw=\/searchresults.html\?ab\=12345\%abc123). But my users are not REGEX savvy. Is there a way to search for characters like %, etc and not use REGEX?

Thanks! Steve

Re: Search for percent symbol in log entries

ftk — Wed, 15 Sep 2010 00:38:29 GMT

You should be able to search just for the percent symbol without escaping it. You can use the backslash to escape special characters such as quotes and backslashes.

index=blah %

Searches index blah for all entries with percent signs.

index=blah \%

works as well.

Re: Search for percent symbol in log entries

gkanapathy — Wed, 15 Sep 2010 00:39:16 GMT

Seems to me you can really just search for "%" or "25%", either with or without the quotes. Works for me, at least with the default segmentation settings.

Re: Search for percent symbol in log entries

Jeremiah — Wed, 15 Sep 2010 00:44:40 GMT

It wouldn't work if you were trying to search a portion of a string between breakers. In your example, searching for "%" should work ok, but "%abc" would not. So just add a wildcard to the search "%abc*".

Re: Search for percent symbol in log entries

castle1126 — Wed, 15 Sep 2010 01:03:07 GMT

Thanks! This worked great!