Splunk Search

Search for file path and only that file path to come back nothing else

Motivator

hi

I have the following files

/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/logs/traces/
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/logs/traces/
/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/XXX/YYY

when i run the below search i get all the directories back, in this case i just want the one /net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/. Not the other 3

| search File_location = */net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/* 

Cheers for you help 🙂

0 Karma
1 Solution

Motivator

cheers that worked @niketnilay 🙂

| search File_location = "/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/"

View solution in original post

0 Karma

Motivator

cheers that worked @niketnilay 🙂

| search File_location = "/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@robertlynch2020... If you want exact match, you should be taking out the * asterisk wildcard for pattern matching.

| search File_location = "/net/dell427srv/data1/apps/QCST_DBS_RSAT_v3.1.38_MASTER_DONOTRESTART/"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

SplunkTrust
SplunkTrust

@robertlynch2020... Glad it worked. I have converted my comment to answer. Since you have accepted your own answers, please upvote my answer, since it helped 🙂 Cheers!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

SplunkTrust
SplunkTrust

Does this work?

 File_location = */net/dell427srv/data1/apps/*

If so, it might be a segmenter "problem"

0 Karma