How to search for a field whose value is *

[mohankesireddy]

Hi

I have a field whose value is "*", When i use that field value pair splunk is assuming it as a wildcard and returning all values. I am not sure how to search with such a value.

Cheers
mohan

[lukejadamec]

No no no, you need to choose. The price of asking a question is you have to accept an answer if you get one. If there is more then one working answer, then you need to accept my answer.
somesoni2 is not the droid you're looking for.

[mohankesireddy]

Thanks for all the answers

both the below searches worked

Your base search | regex yourfield="[*]"

and

|regex "\*"

[mohankesireddy]

Thanks for all the answers

both the below searches worked

Your base search | regex yourfield="[*]"

|regex "\*"

[lukejadamec]

You cannot use the "*" in a key value pair search, but as the two folks suggested you can use a post-filtering regex.

The book recommends

|regex ".*\*.*"

But, if the value is exactly "*" then

|regex "\*"

should work for you.

Here is the search syntax doc:

http://docs.splunk.com/Documentation/Splunk/6.0/Search/Aboutsearchlanguagesyntax

[mohankesireddy]

Thanks for the answer it worked

[somesoni2]

You can use following to get only the rows which have field="*".

Your base search | regex yourfield="[*]" 

[mohankesireddy]

Thanks Mate it worked

[MuS]

Hi mohankesireddy,

you can use something like this:

YourFancySearchCommand | regex _raw="(?i)YourFieldName=\"*\""

this will search for all YourFieldName's which has a value of *

hope this helps ...

cheers, MuS

[Ayn]

Give us a sample event that you're wanting to match, please.

[mohankesireddy]

Thanks MuS for the quick reply, I tried the above regex but it is not working. my search

index=main host=myapp sourcetype=myaccess | regex _raw="(?i)file_name=\"*\""

I am not getting results.