How to ignore internal indexes when searching?

[splunkreal]

Hello,

| rest /services/data/indexes-extended | eval bd_home_event_min_time=strftime('bucket_dirs.home.event_min_time',"%d/%m/%Y") | eval bd_home_event_max_time=strftime('bucket_dirs.home.event_max_time',"%d/%m/%Y") | eval bd_cold_event_min_time=strftime('bucket_dirs.cold.event_min_time',"%d/%m/%Y") | eval bd_cold_event_max_time=strftime('bucket_dirs.cold.event_max_time',"%d/%m/%Y") | table title,bd_home_event_min_time,bd_home_event_max_time,bd_cold_event_min_time,bd_cold_event_max_time,splunk_server | sort title | where not like(title,"_%")

returns empty result.

However the where clause works if I don't use underscore.

My aim is to ignore internal indexes.

Thanks for your help.

[dmaislin_splunk · Accepted solution]

| rest /services/data/indexes-extended | eval bd_home_event_min_time=strftime('bucket_dirs.home.event_min_time',"%d/%m/%Y") | eval bd_home_event_max_time=strftime('bucket_dirs.home.event_max_time',"%d/%m/%Y") | eval bd_cold_event_min_time=strftime('bucket_dirs.cold.event_min_time',"%d/%m/%Y") | eval bd_cold_event_max_time=strftime('bucket_dirs.cold.event_max_time',"%d/%m/%Y") | table title,bd_home_event_min_time,bd_home_event_max_time,bd_cold_event_min_time,bd_cold_event_max_time,splunk_server | sort title | search title!="_*"

[splunkreal]

Thanks!

By the way what is the difference between * and % (to use wildcard) ?

[sduchene_splunk]

• and % are 2 different things : % are used for date formatting, see https://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Commontimeformatvariables

% is not a wildcard.
for wildcard see : https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Wildcards