Splunk Search

How to search for a field whose value is *

mohankesireddy
Path Finder

Hi

I have a field whose value is "*", When i use that field value pair splunk is assuming it as a wildcard and returning all values. I am not sure how to search with such a value.

Cheers
mohan

Tags (1)

lukejadamec
Super Champion

No no no, you need to choose. The price of asking a question is you have to accept an answer if you get one. If there is more then one working answer, then you need to accept my answer.
somesoni2 is not the droid you're looking for.

0 Karma

mohankesireddy
Path Finder

Thanks for all the answers

both the below searches worked

Your base search | regex yourfield="[*]"

and

|regex "\*"
0 Karma

mohankesireddy
Path Finder

Thanks for all the answers

both the below searches worked

Your base search | regex yourfield="[*]"

|regex "\*"
0 Karma

lukejadamec
Super Champion

You cannot use the "*" in a key value pair search, but as the two folks suggested you can use a post-filtering regex.

The book recommends

|regex ".*\*.*"

But, if the value is exactly "*" then

|regex "\*"

should work for you.

Here is the search syntax doc:

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Aboutsearchlanguagesyntax

mohankesireddy
Path Finder

Thanks for the answer it worked

0 Karma

somesoni2
Revered Legend

You can use following to get only the rows which have field="*".

Your base search | regex yourfield="[*]" 

mohankesireddy
Path Finder

Thanks Mate it worked

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi mohankesireddy,

you can use something like this:

YourFancySearchCommand | regex _raw="(?i)YourFieldName=\"*\""

this will search for all YourFieldName's which has a value of *

hope this helps ...

cheers, MuS

0 Karma

Ayn
Legend

Give us a sample event that you're wanting to match, please.

mohankesireddy
Path Finder

Thanks MuS for the quick reply, I tried the above regex but it is not working. my search

index=main host=myapp sourcetype=myaccess | regex _raw="(?i)file_name=\"*\""

I am not getting results.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...