Splunk Search

Search for *

rayar
Contributor

I want to search for "index=*" ....

what is the best way to run it  ?

I tried to run "index=\*" but it's not working 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rayar,

let me understand: do you want to run a search that matches the string "index=*"?

If this is your need you could use the regex command:

something like this:

your_search
| regex _raw="index\=\*"

Ciao.

Giuseppe

View solution in original post

0 Karma

Random_Walk
Path Finder

Hello Sir,

If I understand you want to find the string 'Index=*' somewhere in an index. It is an interesting problem, but I think you will find this works

index=_internal AND "Index=" | rex field=_raw "(?<StarDex>Index\=\*)" | search StarDex != ""

OF course replace _internal with the index in which you wish to search

Regards,

R.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rayar,

let me understand: do you want to run a search that matches the string "index=*"?

If this is your need you could use the regex command:

something like this:

your_search
| regex _raw="index\=\*"

Ciao.

Giuseppe

0 Karma

rayar
Contributor

it worked , thanks 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rayar,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To search all indexes, use 

index=*

there's no need to escape the asterisk.  Be warned that your admin may have created workload management rules that block such queries (they tend to be resource-intensive).

If, OTOH, you're trying to find the literal text "index=*" then using quotation marks around the string should be enough.  Again, no need to escape anything.

If those ideas don't help then please detail what is meant by "it's not working".

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...