Splunk Search

How do I search VMware custom attributes?

hark
New Member

We have defined several custom attributes in vCenter that I would like to search on. For example, we have defined a custom attribute as "App" that contains a variety of strings. How can I search on that object looking for a specific string?

Tags (3)
0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

I presume by "custom attribute" you mean that you have a defined a field (called 'App') that shows up in your regular search results. If that's not the case, this answer is completely wrong. 🙂

So, if you want to search for a string in a field named App, you might....

...  App="mysearchstring"

You might need App="mysearchstring*" or even App="*mysearchstring*" depending on how your string is delimited in the event but please try not to not use the wildcards if you don't need them - it'll be way faster without them, or at least without a leading wildcard.

... is just whatever else in the search string you need to bring up the big old pile of results, some of which have App equal to that string you want. Like, source=vmware or sourcetype=vmware or whatever that is.

Here's a handy set of docs to help get started.

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

I presume by "custom attribute" you mean that you have a defined a field (called 'App') that shows up in your regular search results. If that's not the case, this answer is completely wrong. 🙂

So, if you want to search for a string in a field named App, you might....

...  App="mysearchstring"

You might need App="mysearchstring*" or even App="*mysearchstring*" depending on how your string is delimited in the event but please try not to not use the wildcards if you don't need them - it'll be way faster without them, or at least without a leading wildcard.

... is just whatever else in the search string you need to bring up the big old pile of results, some of which have App equal to that string you want. Like, source=vmware or sourcetype=vmware or whatever that is.

Here's a handy set of docs to help get started.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...