Monitoring Splunk

behavior of a "*"

daktapaal
Path Finder

Hi all,

I wanted to know the behavior of *.
When I do index = *, does it get me all the indexes?

I have the following happening.

When I do index = _*, i get two indexes called _aaaindex and _bbbindex.

but when I do index = *, i do not see these indexes (_aaaindex and _bbbindex. ) there.. I would have thought index = * is a super set and it will bring everything back? including ( _* )..

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

Well, indexes whose names start with an underscore, are considered internal, and are not listed unless you explicitly make it so, either by searching for;

index=* OR index=_*

OR

you include the "All Internal indexes" to the set of indexes that are searched by default for your role. Actually, you don't have include "all internal indexes", you pick and choose, just like with normal indexes.


EDIT: lukejadamec is also right, even though this was not part of the question. In regular expressions, the asterisk is a quantifier that means that the preceding group or character can be present zero or more times.7

As part of a search query, it behaves pretty much like wildcards in the file system (or like the .* regex)

/K

0 Karma

lukejadamec
Super Champion

The * in a search will always mean the wildcard any number of any character, it cannot be escaped. If you search for nothing, then you should get an error because the search term is missing.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!