topic Re: How to use punctuation in a search string: (), [], and *? in Splunk Search

How to use punctuation in a search string: (), [], and *?

lzamora33 — Thu, 23 Apr 2020 21:08:50 GMT

Hi there,

Really basic question but I can't find a detailed answer.
Can someone explain the different uses of (), [], and example in the search app?

Thanks in advance.

Re: How to use punctuation in a search string: (), [], and *?

rkyadav — Thu, 23 Apr 2020 21:31:39 GMT

example : (warn OR error) NOT fail*

Retrieves all events containing either
“warn” or “error”, but not those that
have “fail”, “fails”, “failed”, failure”,
etc.

example 2 : sourcetype=syslog [search login error | return user]

here, search command, like all commands, can be used as a subsearch—a
search whose results are used as an argument to another search command.
Subsearches are enclosed in square brackets. For example, to find
all syslog events from the user that had the last login error, use the following
command: sourcetype=syslog [search login error | return user]

hope it gives some help to your query

Re: How to use punctuation in a search string: (), [], and *?

lzamora33 — Thu, 23 Apr 2020 22:07:00 GMT

Thanks buddy, that's what i was looking for.

Re: How to use punctuation in a search string: (), [], and *?

lzamora33 — Thu, 23 Apr 2020 22:41:31 GMT

last question, what happen whit a search between asterisks example source_type = asterisksexampleasterisks

Re: How to use punctuation in a search string: (), [], and *?

rkyadav — Wed, 30 Sep 2020 05:08:34 GMT

when you search for sourcetype=example , it will fetch all sourcetype which has example as suffix or prefix .

like sourcetypes one_example or example_two will be displayed

Re: How to use punctuation in a search string: (), [], and *?

sensitive-thug — Mon, 27 Apr 2020 16:51:29 GMT

Thank you for asking a question, I'm glad you found a helpful answer from @rkyadav. If their answer solved your issue please accept their answer.