Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Installation
- :
- Re: How we can does masive change of sintax to se...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
we are planning to upgrade our splunk platform from version 6.4 to version 7.3. We implemented a server with version 7.3 and detected a change in the syntax of our search queries.
we want to know if there is any mechanism to change the syntax automatically
thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't recall a specific change that introduced that syntax, but it's been a long time since I used Splunk 6.x.
There is no automatic method to update all of your searches. Any automation would have to understand when you meant "PECconseu" or "PECconseu". Youll just have to review all of your queries to find those that need updating. Fortunately, the new syntax works in old versions of Splunk so you can start changing them now.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't recall a specific change that introduced that syntax, but it's been a long time since I used Splunk 6.x.
There is no automatic method to update all of your searches. Any automation would have to understand when you meant "PECconseu" or "PECconseu". Youll just have to review all of your queries to find those that need updating. Fortunately, the new syntax works in old versions of Splunk so you can start changing them now.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
(old query -> search = index="index_nueva_internet_personas" PECconsdeu OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos)
(new query -> search = index="index_nueva_internet_personas" "*PECconsdeu*" OR "*PEC consdeu*"|search ESTADO_TRX="*R*"|stats count as Rechazos)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you be more specific about the syntax change you found?
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Rich, thanks for your reply
old query -> search = index="index_nueva_internet_personas" PECconsdeu OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos
new query -> search = index="index_nueva_internet_personas" "PECconsdeu" OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sorry
new query -> search = index="index_nueva_internet_personas" "PECconsdeu" OR "PEC
consdeu"|search ESTADO_TRX="R"|stats count as Rechazos
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this editor delete asterisk character
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Put your queries inside backticks (`) to avoid that.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
(
old query -> search = index="index_nueva_internet_personas" PECconsdeu OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos
new query -> search = index="index_nueva_internet_personas" "*PECconsdeu*" OR "*PEC consdeu*"|search ESTADO_TRX="*R*"|stats count as Rechazos
What Is Splunk? Here’s What You Can Do with Splunk
Level Up Your .conf25: Splunk Arcade Comes to Boston
Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...
