topic Re: Search for * in Splunk Search

Search for *

rayar — Thu, 16 Dec 2021 15:02:43 GMT

I want to search for "index=*" ....

what is the best way to run it ?

I tried to run "index=\*" but it's not working

Re: Search for *

richgalloway — Thu, 16 Dec 2021 16:09:28 GMT

To search all indexes, use

index=*

there's no need to escape the asterisk. Be warned that your admin may have created workload management rules that block such queries (they tend to be resource-intensive).

If, OTOH, you're trying to find the literal text "index=*" then using quotation marks around the string should be enough. Again, no need to escape anything.

If those ideas don't help then please detail what is meant by "it's not working".

Re: Search for *

gcusello — Thu, 16 Dec 2021 16:10:42 GMT

Hi @rayar,

let me understand: do you want to run a search that matches the string "index=*"?

If this is your need you could use the regex command:

something like this:

your_search | regex _raw="index\=\*"

Ciao.

Giuseppe

Re: Search for *

Random_Walk — Thu, 16 Dec 2021 20:01:16 GMT

Hello Sir,

If I understand you want to find the string 'Index=*' somewhere in an index. It is an interesting problem, but I think you will find this works

index=_internal AND "Index=" | rex field=_raw "(?<StarDex>Index\=\*)" | search StarDex != ""

OF course replace _internal with the index in which you wish to search

Regards,

Re: Search for *

rayar — Tue, 21 Dec 2021 13:00:39 GMT

it worked , thanks

Re: Search for *

gcusello — Tue, 21 Dec 2021 13:48:01 GMT

Hi @rayar,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉