Finding substrings

[sloshburch]

When searching for

index=myindex exception

I only get events with the text "exception" surrounded by term separators. Does anyone have any tips for how to also end up getting events with text like "this.is.AnExceptionEvent".

The only way I can think of is to search for "*exception*" but that ends up taking forever because of the massive amount of data that must be searched.

Can anyone spot any trick I've overlooked?

[martin_mueller · Accepted solution]

Searching for *exception* is the way to go, and you're right that it'll take ages. That's because using a wildcard at the beginning of a search phrase kills any chance of looking that up in the index structures. Instead, Splunk has to churn through all the raw data... that's regardless of whether you search for *exception* or field=*exception* in case of search time extraction.

I see two "tricks" you can try. See if there are other identifying keywords for your exception events. If there is, add those to your search to see it speed up massively.
If that's not the case you can consider extracting that field at index time. You'll add a bit of processing overhead to the indexer, but if you search for that field frequently you get that back many times over.

[sloshburch]

Thanks for elaborating. That's what I feared but I was optimistic that maybe I overlooked something trivial. Looks like we're all on the same page. Thanks!

[sloshburch]

I know what you mean. I have the message payload in a field but that still seems to be a slog because its a massive amount of data.

[aweitzman]

Is the text extracted into a known field? Searching for field="*exception*" instead of just *exception* tends to be faster.