topic Wildcards on the left side of a comparison in Splunk Search

Wildcards on the left side of a comparison

jerdmann — Tue, 07 Jan 2014 15:49:18 GMT

Is there any way to use a wildcard on the left side of a comparison in a Splunk search? We have a scripted input that returns physical drive status across many systems, and the results look like this:

hostname=some_hostname physDrv1=ok physDrv2=ok physDrv3=ok physDrv4=failed

Is there any way to search for events that have any non-OK lines like below? This apparently doesn't work and I haven't found anything in the Splunk documentation.

sourcetype=drive_status | where physDrv*!="ok"

For now, we just hardcode every possible drive property in the search like below and it works fine, but it would be cool to write a more elegant search if possible. Let me know what you think. Thanks for the help!

sourcetype=drive_status | where physDrv1!="ok" OR physDrv2!="ok" OR physDrv3!="ok" OR physDrv4!="ok"

Re: Wildcards on the left side of a comparison

lukejadamec — Tue, 07 Jan 2014 15:59:22 GMT

You could try:

sourcetype=drive_status NOT "ok" | your stats or table

But you have to be careful how you use it because it will ignore "ok" regardless of the field. In your example, it looks like ignoring "ok" will not be a problem.

Re: Wildcards on the left side of a comparison

jerdmann — Tue, 07 Jan 2014 16:02:08 GMT

Cool, thanks for the feedback. I'm not sure if this will work though, as it looks like this filters out all events that have the text "ok" anywhere in them.

I gave it a shot and it filters out all results which obviously isn't what we want. Thanks for the suggestion though!

Re: Wildcards on the left side of a comparison

somesoni2 — Tue, 07 Jan 2014 16:06:57 GMT

Try following

index=blah sourcetype=blah NOT "physDrv*=ok" | <do more>

UPDATED Search

Try this

index=blah sourcetype=blah | rex max_match=0 "(?m)physDrv[0-9]*=(?<drive_status>[^ ]+)" | nomv drive_status | eval drive_status=replace(drive_status,"ok","") | where drive_status!=""

Re: Wildcards on the left side of a comparison

jerdmann — Tue, 07 Jan 2014 16:32:52 GMT

Hmmm, no dice here either. This filters out all events that an OK in any of the drives/properties, similar to the above suggestion.

Re: Wildcards on the left side of a comparison

somesoni2 — Tue, 07 Jan 2014 16:58:08 GMT

Please see if the updated answer works.

Re: Wildcards on the left side of a comparison

jerdmann — Mon, 28 Sep 2020 15:36:07 GMT

Perfect, works like a treat! I had to modify the above slightly (see below), but this is otherwise exactly what I needed. Thanks a ton!

rex max_match=0 "(?m)physDrv[0-9]+=(?[\w]+)" | nomv drive_status | eval drive_status=replace(drive_status,"ok\s*","") | where drive_status!=""