Splunk Search

How do I get only values ending with, say $, from a search

vhuphilo
Engager

I would like to search for values that end with or begin with specific characters

Tags (1)
0 Karma

lukejadamec
Super Champion

You need to specify both the beginning and ending characters if you're going to extract the values from _raw.
If you are looking at a specific field like 'AccountName' and you only want account names that end with $, then you can use wildcards in your search, like:

YourSearch  AccountName=*$
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...