topic Re: How to search for a field whose value is * in Splunk Search

How to search for a field whose value is *

mohankesireddy — Mon, 25 Nov 2013 07:15:54 GMT

I have a field whose value is "*", When i use that field value pair splunk is assuming it as a wildcard and returning all values. I am not sure how to search with such a value.

Cheers
mohan

Re: How to search for a field whose value is *

MuS — Mon, 25 Nov 2013 07:27:03 GMT

Hi mohankesireddy,

you can use something like this:

YourFancySearchCommand | regex _raw="(?i)YourFieldName=\"*\""

this will search for all YourFieldName's which has a value of *

hope this helps ...

cheers, MuS

Re: How to search for a field whose value is *

mohankesireddy — Mon, 25 Nov 2013 08:15:04 GMT

Thanks MuS for the quick reply, I tried the above regex but it is not working. my search

index=main host=myapp sourcetype=myaccess | regex _raw="(?i)file_name=\"*\""

I am not getting results.

Re: How to search for a field whose value is *

Ayn — Mon, 25 Nov 2013 08:28:38 GMT

Give us a sample event that you're wanting to match, please.

Re: How to search for a field whose value is *

somesoni2 — Mon, 25 Nov 2013 17:06:48 GMT

You can use following to get only the rows which have field="*".

Your base search | regex yourfield="[*]"

Re: How to search for a field whose value is *

lukejadamec — Mon, 25 Nov 2013 17:31:02 GMT

You cannot use the "*" in a key value pair search, but as the two folks suggested you can use a post-filtering regex.

The book recommends

|regex ".*\*.*"

But, if the value is exactly "*" then

|regex "\*"

should work for you.

Here is the search syntax doc:

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Aboutsearchlanguagesyntax

Re: How to search for a field whose value is *

mohankesireddy — Mon, 25 Nov 2013 23:01:37 GMT

Thanks Mate it worked

Re: How to search for a field whose value is *

mohankesireddy — Mon, 25 Nov 2013 23:03:50 GMT

Thanks for all the answers

both the below searches worked

Your base search | regex yourfield="[*]"

|regex "\*"

Re: How to search for a field whose value is *

mohankesireddy — Mon, 25 Nov 2013 23:04:01 GMT

Thanks for all the answers

both the below searches worked

Your base search | regex yourfield="[*]"

and

|regex "\*"

Re: How to search for a field whose value is *

mohankesireddy — Mon, 25 Nov 2013 23:07:15 GMT

Thanks for the answer it worked

Re: How to search for a field whose value is *

lukejadamec — Tue, 26 Nov 2013 00:49:10 GMT

No no no, you need to choose. The price of asking a question is you have to accept an answer if you get one. If there is more then one working answer, then you need to accept my answer.
somesoni2 is not the droid you're looking for.