Installation

How we can does masive change of sintax to searchs queries relative to upgrade saplunk version from 6.4 to 6.5 and finnaly 7.3?

fernandomcg
New Member

Hello,
we are planning to upgrade our splunk platform from version 6.4 to version 7.3. We implemented a server with version 7.3 and detected a change in the syntax of our search queries.
we want to know if there is any mechanism to change the syntax automatically

thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I don't recall a specific change that introduced that syntax, but it's been a long time since I used Splunk 6.x.
There is no automatic method to update all of your searches. Any automation would have to understand when you meant "PECconseu" or "PECconseu". Youll just have to review all of your queries to find those that need updating. Fortunately, the new syntax works in old versions of Splunk so you can start changing them now.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I don't recall a specific change that introduced that syntax, but it's been a long time since I used Splunk 6.x.
There is no automatic method to update all of your searches. Any automation would have to understand when you meant "PECconseu" or "PECconseu". Youll just have to review all of your queries to find those that need updating. Fortunately, the new syntax works in old versions of Splunk so you can start changing them now.

---
If this reply helps you, Karma would be appreciated.
0 Karma

fernandomcg
New Member

(old query -> search = index="index_nueva_internet_personas" PECconsdeu OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos)
(new query -> search = index="index_nueva_internet_personas" "*PECconsdeu*" OR "*PEC consdeu*"|search ESTADO_TRX="*R*"|stats count as Rechazos)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Could you be more specific about the syntax change you found?

---
If this reply helps you, Karma would be appreciated.
0 Karma

fernandomcg
New Member

Hi Rich, thanks for your reply

old query -> search = index="index_nueva_internet_personas" PECconsdeu OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos

new query -> search = index="index_nueva_internet_personas" "PECconsdeu" OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos

0 Karma

fernandomcg
New Member

sorry

new query -> search = index="index_nueva_internet_personas" "PECconsdeu" OR "PEC
consdeu
"|search ESTADO_TRX="R"|stats count as Rechazos

0 Karma

fernandomcg
New Member

this editor delete asterisk character

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Put your queries inside backticks (`) to avoid that.

---
If this reply helps you, Karma would be appreciated.
0 Karma

fernandomcg
New Member

(
old query -> search = index="index_nueva_internet_personas" PECconsdeu OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos
new query -> search = index="index_nueva_internet_personas" "*PECconsdeu*" OR "*PEC consdeu*"|search ESTADO_TRX="*R*"|stats count as Rechazos
)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...