Splunk Search

Search for file path and only that file path to come back nothing else

robertlynch2020
Motivator

hi

I have the following files

/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/logs/traces/
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/logs/traces/
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/XXX/YYY

when i run the below search i get all the directories back, in this case i just want the one /net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/. Not the other 3

| search File_location = */net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/* 

Cheers for you help 🙂

0 Karma
1 Solution

robertlynch2020
Motivator

cheers that worked @niketn-deceased 🙂

| search File_location = "/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/"

View solution in original post

0 Karma

robertlynch2020
Motivator

cheers that worked @niketn-deceased 🙂

| search File_location = "/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/"

0 Karma

@robertlynch2020... If you want exact match, you should be taking out the * asterisk wildcard for pattern matching.

| search File_location = "/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

@robertlynch2020... Glad it worked. I have converted my comment to answer. Since you have accepted your own answers, please upvote my answer, since it helped 🙂 Cheers!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jkat54
SplunkTrust
SplunkTrust

Does this work?

 File_location = */net/dell427srv/data1/apps/*

If so, it might be a segmenter "problem"

0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...