Monitoring Splunk

behavior of a "*"

Path Finder

Hi all,

I wanted to know the behavior of *.
When I do index = *, does it get me all the indexes?

I have the following happening.

When I do index = _*, i get two indexes called _aaaindex and _bbbindex.

but when I do index = *, i do not see these indexes (_aaaindex and _bbbindex. ) there.. I would have thought index = * is a super set and it will bring everything back? including ( _* )..

Tags (2)
0 Karma

Ultra Champion

Well, indexes whose names start with an underscore, are considered internal, and are not listed unless you explicitly make it so, either by searching for;

index=* OR index=_*


you include the "All Internal indexes" to the set of indexes that are searched by default for your role. Actually, you don't have include "all internal indexes", you pick and choose, just like with normal indexes.

EDIT: lukejadamec is also right, even though this was not part of the question. In regular expressions, the asterisk is a quantifier that means that the preceding group or character can be present zero or more times.7

As part of a search query, it behaves pretty much like wildcards in the file system (or like the .* regex)


0 Karma

Super Champion

The * in a search will always mean the wildcard any number of any character, it cannot be escaped. If you search for nothing, then you should get an error because the search term is missing.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...