Dashboards & Visualizations

Which data type is allowed for using a wildcard?


I'm a rookie at splunk and trying to implement a wildcard search via input type text in a dashboard. Unfortunately it seems, that the
constellation "Wildcard", "input type="text"" and data type "UINT32" won't work.
I've tested the search with other data types and it worked well. Has anybody made same experience with this and even more, has found a way to solve this kinda problem?
Please, dont ask why "UINT32" is used, it was a decision made by our company.

Thanks so far!

0 Karma

Esteemed Legend

If your question is can I search for a literal asterisk, then the answer is no. You'll have to search more broadly and then trim down the results with another filtering command that can handle a literal asterisk, such as regex like this:

| regex _raw="hello\*world"
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...