topic Re: Search for field with '*' in Splunk Search

Search for field with '*'

Jiten009 — Wed, 13 Mar 2013 21:31:26 GMT

Hi,
I need to search for logs with only query="*" but when I am putting in my search its fetching all the logs with query="*", query="logo", query="link", since Spluk is treating * as wildcard. So what should be the query ? My logs below :

INFO 2013-03-13 14:03:15 endPoint=search,host=168.94.64.138,remoteAdress=167.209.125.121,query="*",brand_facet=All Chairs,status="Success"

INFO 2013-03-13 14:07:35 endPoint=search,host=168.94.64.138,remoteAdress=167.209.125.121,query="logo",brand_facet=Logo Chairs,status="Success"

INFO 2013-03-13 14:09:41 endPoint=search,host=168.94.64.138,remoteAdress=167.209.125.121,query="link",brand_facet=Link Chairs,status="Success"

Thanks in advance for any help.

Re: Search for field with '*'

jeff — Wed, 13 Mar 2013 22:02:27 GMT

Something like this should work:

"query" | regex _raw="(?i)query=\"*\""

but that'll be awful inefficient since it will return all lines with "query" (presumably every record in your index for this sourcetype) then filter based on the regex. You'll be better off if you can add additional criteria to filter it, or replace the * character at index time using SEDCMD, for instance...

Re: Search for field with '*'

martin_mueller — Wed, 13 Mar 2013 22:20:05 GMT

I'm not sure how efficient this will be, but it's worth a try:

query>="*" query<="*"