topic Re: Is there any workaround in Splunk to make a star to be considered as constant instead of wild card? in Splunk Search

Is there any workaround in Splunk to make a star to be considered as constant instead of wild card?

pavanae — Thu, 12 Oct 2017 03:52:04 GMT

I have some fields as follows

sql="Select * from & ABC"
sql="Select * from xyz.ABC"
sql="Select * from gh2_ABC"
sql="Select * from 34,rABC"
sql="Select * from xyz.gfr"

Now I am trying to work on an event type as follows

eventtype name :- test

sourcetype="web" sql="Select * from *ABC"

And now I want to consider the first star as a constant and the second star as a wild card. Is there any workaround in Splunk to make a star to be considered as constant instead of wild card?

Re: Is there any workaround in Splunk to make a star to be considered as constant instead of wild card?

DalJeanis — Thu, 12 Oct 2017 04:58:18 GMT

In search, an asterisk is a wildcard. There is no workaround.

In a regex, an asterisk can be either a repeater, or it can be escaped \* to be a plain asterisk.

When using | like(), asterisk is a regular character and % is a wildcard.

Re: Is there any workaround in Splunk to make a star to be considered as constant instead of wild card?

cpetterborg — Thu, 12 Oct 2017 05:09:24 GMT

As far as I know there is no base search (with the search command) that will make a * be a constant. But you can use the regex command to do an asterisk as a constant. For example, the following works to find the asterisk as an asterisk:

| makeresults 
| eval raw="sql=\"Select from & ABC\"
sql=\"Select from xyz.ABC\"
sql=\"Select * from xyz.gfr\""
|  makemv raw delim="
"  | mvexpand raw 
|  rename raw as _raw 
|  regex "Select \*"

If you change the regex to search, you will get all three events, instead of just one. Hopefully this is something that you can use in your application.