Search for field with '*'

[Jiten009]

Hi,
I need to search for logs with only query="*" but when I am putting in my search its fetching all the logs with query="*", query="logo", query="link", since Spluk is treating * as wildcard. So what should be the query ? My logs below :

INFO 2013-03-13 14:03:15 endPoint=search,host=168.94.64.138,remoteAdress=167.209.125.121,query="*",brand_facet=All Chairs,status="Success"

INFO 2013-03-13 14:07:35 endPoint=search,host=168.94.64.138,remoteAdress=167.209.125.121,query="logo",brand_facet=Logo Chairs,status="Success"

INFO 2013-03-13 14:09:41 endPoint=search,host=168.94.64.138,remoteAdress=167.209.125.121,query="link",brand_facet=Link Chairs,status="Success"

Thanks in advance for any help.

[martin_mueller]

I'm not sure how efficient this will be, but it's worth a try:

query>="*" query<="*"

[jeff]

Something like this should work:

"query" | regex _raw="(?i)query=\"*\""

but that'll be awful inefficient since it will return all lines with "query" (presumably every record in your index for this sourcetype) then filter based on the regex. You'll be better off if you can add additional criteria to filter it, or replace the * character at index time using SEDCMD, for instance...