topic Re: is * supported? in Splunk Search

is * supported?

riderofyamaha — Wed, 30 Jun 2010 22:17:23 GMT

Is the wildcard search star * supported by logs in splunk? Im trying to see if splunk is seeing changes being made in log files..

Re: is * supported?

simuvid — Wed, 30 Jun 2010 22:37:27 GMT

Splunk supports the asterisk (*) wildcard for searching. Searching for * by itself means "match all" and returns all events. Searching for * as part of a word matches based on that word: for example fail* matches fail, failure, and failures. See also:

http://www.splunk.com/base/Documentation/4.1.3/User/Startsearchingtutorial#Search_with_wildcards

I am not sure which changes you try to identify, but you can use fschange to detect chages in files.

Re: is * supported?

Lowell — Wed, 30 Jun 2010 22:40:51 GMT

BTW, searching for a literal '' in your search is not currently supported (unless you disable '' as a wildcard)

Re: is * supported?

riderofyamaha — Thu, 01 Jul 2010 19:24:12 GMT

yeah, that helps, thanks alot