behavior of a "*"

[daktapaal]

Hi all,

I wanted to know the behavior of *.
When I do index = *, does it get me all the indexes?

I have the following happening.

When I do index = _*, i get two indexes called _aaaindex and _bbbindex.

but when I do index = *, i do not see these indexes (_aaaindex and _bbbindex. ) there.. I would have thought index = * is a super set and it will bring everything back? including ( _* )..

[kristian_kolb]

Well, indexes whose names start with an underscore, are considered internal, and are not listed unless you explicitly make it so, either by searching for;

index=* OR index=_*

OR

you include the "All Internal indexes" to the set of indexes that are searched by default for your role. Actually, you don't have include "all internal indexes", you pick and choose, just like with normal indexes.

---

EDIT: lukejadamec is also right, even though this was not part of the question. In regular expressions, the asterisk is a quantifier that means that the preceding group or character can be present zero or more times.7

As part of a search query, it behaves pretty much like wildcards in the file system (or like the .* regex)

/K

[lukejadamec]

The * in a search will always mean the wildcard any number of any character, it cannot be escaped. If you search for nothing, then you should get an error because the search term is missing.