topic Re: How can I search for all fields that have a certain string? in Splunk Search

How can I search for all fields that have a certain string?

net1993 — Thu, 08 Nov 2018 08:14:17 GMT

Hello

How can I get only results for specific fields where field name is like something ?

fx.
get all fields which have "status" in their field name.

I tried this but It doesnt work:
sta*
I want also to do later this:

sta* OR STA* OR Sta*

Thank you in advance

Re: How can I search for all fields that have a certain string?

sudosplunk — Thu, 08 Nov 2018 14:11:11 GMT

If "status" field is extracted, then you can run index=idx sourcetype=st status=*. This will give all events which have status field.

Re: How can I search for all fields that have a certain string?

net1993 — Tue, 29 Sep 2020 21:56:42 GMT

I think the questioned is not understood.

My problem is that I dont know that status is called status.
It might be status_20 or status_Main
so what I want to find is all fields which starts with st*

Re: How can I search for all fields that have a certain string?

sudosplunk — Thu, 08 Nov 2018 14:30:28 GMT

So the field is not extracted. Try running *status* or *sta* to see exact name and then extract the field.

Re: How can I search for all fields that have a certain string?

net1993 — Thu, 08 Nov 2018 14:34:00 GMT

but from what I understood by other post, such a searching will look only in value but not in field name. Isn't that correct?

What do you mean by extracted for field?
Do you mean that extracted => the field will be lying in left under fields ..?

Re: How can I search for all fields that have a certain string?

sudosplunk — Thu, 08 Nov 2018 14:45:13 GMT

Searching with *string* will search for all the raw events containing string. For example if searched for *status*, splunk will output all the events which contains failed_status, success_status, status, status_failed, status_success

If you say status=fail* then splunk will look only in value of the field called status.

What do you mean by extracted for field?
Do you mean that extracted => the field will be lying in left under fields ..?

Yes. Under "INTERESTING FIELDS" column. After figuring out the name you want to use for status, you can extract a field with that name and use it for future searches.

Re: How can I search for all fields that have a certain string?

net1993 — Thu, 08 Nov 2018 14:50:50 GMT

ok so can tell that the field is already extracted. What my primary goal is that I dont want to screen all available column in left.
I am lazy 😄 so I want to display in front of my eyes in search all field (extracted) which start with "st"

and I guess that status by itself is not in raw data but a metadata.?

Re: How can I search for all fields that have a certain string?

Vijeta — Thu, 08 Nov 2018 15:33:16 GMT

You want to see fieldnames that have status in them and not the field values that have status in them if I understood correctly? If that is the case you can do- | table status

Re: How can I search for all fields that have a certain string?

sudosplunk — Thu, 08 Nov 2018 15:42:19 GMT

Alright, first step is to search for all raw events which have "status" string by using *status* or *stat*. - This will give you an idea about how "status" is represented.

Next step is to extract "status" field so that it will show up in the left column under "Interested fields". - For this provide redacted events from the above output results which shows all possible values for "status" and I can help you build a regex for field extraction.

Re: How can I search for all fields that have a certain string?

kmaron — Thu, 08 Nov 2018 20:24:37 GMT

| fieldsummary  sta* STA* Sta*

Re: How can I search for all fields that have a certain string?

net1993 — Fri, 09 Nov 2018 07:09:13 GMT

ok I try that and give feedback
Thank you @sudosplunk

Re: How can I search for all fields that have a certain string?

net1993 — Fri, 09 Nov 2018 11:23:30 GMT

yes but not sure if we talk for same.
please refer to @kmaron response as it is exactly what I was looking for

Re: How can I search for all fields that have a certain string?

net1993 — Fri, 09 Nov 2018 11:24:15 GMT

Exactly this. Thanks !