How we can does masive change of sintax to searchs queries relative to upgrade saplunk version from 6.4 to 6.5 and finnaly 7.3?

[fernandomcg]

Hello,
we are planning to upgrade our splunk platform from version 6.4 to version 7.3. We implemented a server with version 7.3 and detected a change in the syntax of our search queries.
we want to know if there is any mechanism to change the syntax automatically

thanks

[richgalloway · Accepted solution]

I don't recall a specific change that introduced that syntax, but it's been a long time since I used Splunk 6.x.
There is no automatic method to update all of your searches. Any automation would have to understand when you meant "PECconseu" or "PECconseu". Youll just have to review all of your queries to find those that need updating. Fortunately, the new syntax works in old versions of Splunk so you can start changing them now.

[fernandomcg]

(old query -> search = index="index_nueva_internet_personas" PECconsdeu OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos)
(new query -> search = index="index_nueva_internet_personas" "*PECconsdeu*" OR "*PEC consdeu*"|search ESTADO_TRX="*R*"|stats count as Rechazos)

[richgalloway]

Could you be more specific about the syntax change you found?

[fernandomcg]

Hi Rich, thanks for your reply

old query -> search = index="index_nueva_internet_personas" PECconsdeu OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos

new query -> search = index="index_nueva_internet_personas" "PECconsdeu" OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos

[fernandomcg]

sorry

new query -> search = index="index_nueva_internet_personas" "PECconsdeu" OR "PEC
consdeu"|search ESTADO_TRX="R"|stats count as Rechazos

[fernandomcg]

this editor delete asterisk character

[richgalloway]

Put your queries inside backticks (`) to avoid that.

[fernandomcg]

(
old query -> search = index="index_nueva_internet_personas" PECconsdeu OR "PEC consdeu"|search ESTADO_TRX="R"|stats count as Rechazos
new query -> search = index="index_nueva_internet_personas" "*PECconsdeu*" OR "*PEC consdeu*"|search ESTADO_TRX="*R*"|stats count as Rechazos
)