Splunk Search

Finding substrings

sloshburch
Splunk Employee
Splunk Employee

When searching for

index=myindex exception

I only get events with the text "exception" surrounded by term separators. Does anyone have any tips for how to also end up getting events with text like "this.is.AnExceptionEvent".

The only way I can think of is to search for "*exception*" but that ends up taking forever because of the massive amount of data that must be searched.

Can anyone spot any trick I've overlooked?

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Searching for *exception* is the way to go, and you're right that it'll take ages. That's because using a wildcard at the beginning of a search phrase kills any chance of looking that up in the index structures. Instead, Splunk has to churn through all the raw data... that's regardless of whether you search for *exception* or field=*exception* in case of search time extraction.

I see two "tricks" you can try. See if there are other identifying keywords for your exception events. If there is, add those to your search to see it speed up massively.
If that's not the case you can consider extracting that field at index time. You'll add a bit of processing overhead to the indexer, but if you search for that field frequently you get that back many times over.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Searching for *exception* is the way to go, and you're right that it'll take ages. That's because using a wildcard at the beginning of a search phrase kills any chance of looking that up in the index structures. Instead, Splunk has to churn through all the raw data... that's regardless of whether you search for *exception* or field=*exception* in case of search time extraction.

I see two "tricks" you can try. See if there are other identifying keywords for your exception events. If there is, add those to your search to see it speed up massively.
If that's not the case you can consider extracting that field at index time. You'll add a bit of processing overhead to the indexer, but if you search for that field frequently you get that back many times over.

sloshburch
Splunk Employee
Splunk Employee

Thanks for elaborating. That's what I feared but I was optimistic that maybe I overlooked something trivial. Looks like we're all on the same page. Thanks!

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I know what you mean. I have the message payload in a field but that still seems to be a slog because its a massive amount of data.

0 Karma

aweitzman
Motivator

Is the text extracted into a known field? Searching for field="*exception*" instead of just *exception* tends to be faster.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...