topic Re: splunk search language in Splunk Search

splunk search language

kenchisho — Wed, 01 Jun 2011 10:09:22 GMT

Hi guys...

I have been working on a few splunk apps during the last 6 months... in that time i have ran into a peculiar problem a couple of times... the problem being the folowing:

when i use a search like:

index="index" sourcetype="sourcertype" field1="*" field2="*"

I expect all the results because i am not filtering anything... but instead i get only a small fraction of the indexed logs...

when i use the same search only writted differently like so:

index="index" sourcetype="sourcertype" NOT (field1!="*" field2!="*")

I get all the indexed data as expected...

Has anyone else ran into this or is it just me?

and

Has anyone found a solution to this besides rewriting the search to say the exactly the same thing...

Re: splunk search language

ziegfried — Wed, 01 Jun 2011 11:56:25 GMT

field1="*"

will filter and return all events where field1 is present.

Re: splunk search language

khodges_splunk — Wed, 01 Jun 2011 14:29:07 GMT

Exactly, and so you might ask why your second search works. Well, here's why:

field=* returns all events that have a value in that field; i.e. NOT NULL

So, you might expect that field!=* would return all events where there is not a value in the specified field i.e. NULL. But, that is not the case.

The way to search for NULL values is with:
NOT field=*

Go ahead and test a search with field!=* and you will get 0 matching results. This appears to be an exception to where NOT and ! do not return the same results. Or, I'm not understanding the difference clearly enough.

So, in your example your field=* term was in fact filtering out events. Specifically those that don't have a value in the specified field. (You might want to investigate why that is the case if it is not what you are expecting).

In your second example when you negate field!=* (which returns 0 results) with NOT field!=* you get all results.

It seems like in your example you just need to use index="index" and sourcetype="sourcetype"

I hope this helps.

Re: splunk search language

kenchisho — Wed, 01 Jun 2011 18:35:04 GMT

Thanks for the quick answer.

Re: splunk search language

kenchisho — Wed, 01 Jun 2011 18:43:28 GMT

Thank you also for the quick answer...

i can't just use index and sourcetype because i run postprocess searches on the results and i get nothing unless i specify the fields=*...

using the NOT != is a bit messy...

i resolved my issue by using eval to write "NULL" into the empty fields.

Again thanks for the help.

Re: splunk search language

JoeSco27 — Fri, 06 Sep 2013 18:56:24 GMT

I am running into the same problem, can you share the eval command you ran to write NULL in the empty fields?