Getting Data In

How to ignore internal indexes when searching?

Builder

Hello,

| rest /services/data/indexes-extended | eval bdhomeeventmintime=strftime('bucketdirs.home.eventmintime',"%d/%m/%Y") | eval bdhomeeventmaxtime=strftime('bucketdirs.home.eventmaxtime',"%d/%m/%Y") | eval bdcoldeventmintime=strftime('bucketdirs.cold.eventmintime',"%d/%m/%Y") | eval bdcoldeventmaxtime=strftime('bucketdirs.cold.eventmaxtime',"%d/%m/%Y") | table title,bdhomeeventmintime,bdhomeeventmaxtime,bdcoldeventmintime,bdcoldeventmaxtime,splunkserver | sort title **| where not like(title,"%")**

returns empty result.

However the where clause works if I don't use underscore.

My aim is to ignore internal indexes.

Thanks for your help.

1 Solution

Splunk Employee
Splunk Employee
| rest /services/data/indexes-extended | eval bd_home_event_min_time=strftime('bucket_dirs.home.event_min_time',"%d/%m/%Y") | eval bd_home_event_max_time=strftime('bucket_dirs.home.event_max_time',"%d/%m/%Y") | eval bd_cold_event_min_time=strftime('bucket_dirs.cold.event_min_time',"%d/%m/%Y") | eval bd_cold_event_max_time=strftime('bucket_dirs.cold.event_max_time',"%d/%m/%Y") | table title,bd_home_event_min_time,bd_home_event_max_time,bd_cold_event_min_time,bd_cold_event_max_time,splunk_server | sort title | search title!="_*"

View solution in original post

Splunk Employee
Splunk Employee
| rest /services/data/indexes-extended | eval bd_home_event_min_time=strftime('bucket_dirs.home.event_min_time',"%d/%m/%Y") | eval bd_home_event_max_time=strftime('bucket_dirs.home.event_max_time',"%d/%m/%Y") | eval bd_cold_event_min_time=strftime('bucket_dirs.cold.event_min_time',"%d/%m/%Y") | eval bd_cold_event_max_time=strftime('bucket_dirs.cold.event_max_time',"%d/%m/%Y") | table title,bd_home_event_min_time,bd_home_event_max_time,bd_cold_event_min_time,bd_cold_event_max_time,splunk_server | sort title | search title!="_*"

View solution in original post

Builder

Thanks!

By the way what is the difference between * and % (to use wildcard) ?

0 Karma

Splunk Employee
Splunk Employee

% is not a wildcard.
for wildcard see : https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Wildcards

0 Karma