topic Re: How to search for "*" (asterisk) values in a field? in Splunk Search

How to search for "*" (asterisk) values in a field?

kendelar — Tue, 05 Apr 2016 07:31:47 GMT

Hi,

I have TYPE field, that have a value of *, **, ***.

When I'm trying to |search TYPE="*" (all of the events will be shown, all of the values)
and when I use |regex TYPE="\*" (all of the *,**,** will be shown.)

I need help for searching * ,**, *** in a specific field..

Thank you.

Re: How to search for "*" (asterisk) values in a field?

somesoni2 — Tue, 05 Apr 2016 14:55:33 GMT

Try something like this

your base search | where TYPE="*"                  ***to filter rows with TYPE=*
your base search | where TYPE="***"                  ***to filter rows with TYPE=***

Re: How to search for "*" (asterisk) values in a field?

ElijahLynn — Thu, 22 Feb 2018 04:15:09 GMT

Welp, just came across your question and was wondering the same thing, not great news:

Splunk SPL uses the asterisk ( * ) as a wildcard character. The backslash cannot be used to escape the asterisk in search strings.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/SPLandregularexpressions

Re: How to search for "*" (asterisk) values in a field?

sleepingstarfir — Thu, 01 Aug 2019 22:02:19 GMT

We just tried this, and indeed you can use "" in a `where fieldname=""` query, and it will work. No backslash required.

Re: How to search for "*" (asterisk) values in a field?

johnebgood — Fri, 15 Nov 2019 17:20:39 GMT

You can also do something like this:

| eval has_asterisks=if(like(field, "%*%"), 1, 0)
| where has_asterisks=1