Splunk Search

How to combine two of the same type of message string and show table data?

anirban_nag
Explorer

I have one index as foo. In this index there are messages like Bar Baz Hello...., Bar Baz Blah..., Bar Hi.... I want to show the data of the events corresponding with the message which starts with Bar Baz so Bar Hi... will not be shown. I am trying with the following search:

index=foo message="Bar Baz"* | table message _time data

But it is showing nothing. I know I am missing something.

Tags (3)
0 Karma
1 Solution

javiergn
Super Champion

There's a typo in your search. Wildcats should go inside the double quotes:

index=foo message="Bar Baz*" | table message _time data

View solution in original post

javiergn
Super Champion

There's a typo in your search. Wildcats should go inside the double quotes:

index=foo message="Bar Baz*" | table message _time data
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...