Hi
I have a field whose value is "*", When i use that field value pair splunk is assuming it as a wildcard and returning all values. I am not sure how to search with such a value.
Cheers
mohan
No no no, you need to choose. The price of asking a question is you have to accept an answer if you get one. If there is more then one working answer, then you need to accept my answer.
somesoni2 is not the droid you're looking for.
Thanks for all the answers
both the below searches worked
Your base search | regex yourfield="[*]"
and
|regex "\*"
Thanks for all the answers
both the below searches worked
Your base search | regex yourfield="[*]"
|regex "\*"
You cannot use the "*" in a key value pair search, but as the two folks suggested you can use a post-filtering regex.
The book recommends
|regex ".*\*.*"
But, if the value is exactly "*" then
|regex "\*"
should work for you.
Here is the search syntax doc:
http://docs.splunk.com/Documentation/Splunk/6.0/Search/Aboutsearchlanguagesyntax
Thanks for the answer it worked
You can use following to get only the rows which have field="*".
Your base search | regex yourfield="[*]"
Thanks Mate it worked
Hi mohankesireddy,
you can use something like this:
YourFancySearchCommand | regex _raw="(?i)YourFieldName=\"*\""
this will search for all YourFieldName's
which has a value of *
hope this helps ...
cheers, MuS
Give us a sample event that you're wanting to match, please.
Thanks MuS for the quick reply, I tried the above regex but it is not working. my search
index=main host=myapp sourcetype=myaccess | regex _raw="(?i)file_name=\"*\""
I am not getting results.