Splunk Search

How to search for "*" (asterisk) values in a field?

kendelar
Engager

Hi,

I have TYPE field, that have a value of *, **, ***.

When I'm trying to |search TYPE="*" (all of the events will be shown, all of the values)
and when I use |regex TYPE="\*" (all of the *,**,** will be shown.)

I need help for searching * ,**, *** in a specific field..

Thank you.

johnebgood
Path Finder

You can also do something like this:

| eval has_asterisks=if(like(field, "%*%"), 1, 0)
| where has_asterisks=1
0 Karma

ElijahLynn
Explorer

Welp, just came across your question and was wondering the same thing, not great news:

Splunk SPL uses the asterisk ( * ) as a wildcard character. The backslash cannot be used to escape the asterisk in search strings.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Search/SPLandregularexpressions

sleepingstarfir
Engager

We just tried this, and indeed you can use "" in a `where fieldname=""` query, and it will work. No backslash required.

somesoni2
Revered Legend

Try something like this

your base search | where TYPE="*"                  ***to filter rows with TYPE=*
your base search | where TYPE="***"                  ***to filter rows with TYPE=***
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...