Splunk Search

Wildcard search not producing accurate results



I am running a wild card search as i am using an input window (with the default value as a wildcard search that will produce everything). The issue is that even though all the values are set at * for wildcard when i remove these searches completely i get more events. So events are being lost and i am trying to figure out what.

sourcetype="test.csv"| eval Created=strftime(_time, "%d/%m/%Y %I:%M:%S %p")   |
search Username="*" AND Hostname="*" AND Category="*" | search Status="*" | search Username="*" AND Hostname="*" AND Category="*" | search Status="Closed" OR  Status="False Positive" | search UserAction="*"
|  table ISCM Category Created Priority UserAction Hostname Username Subject | sort by Created

I have completed a eval Created at the start of this as the input csv is indexing the updated time and i am changing this back. So the above search i get 410 events. But if i take out | search Status="*" | search Username="*" AND Hostname="*" AND Category="*" i get over 50 more entries which is confusing.

Anything else i can do as i need these search fields so the user can pick categories, usernames, hostnames and when they dont i just want everything but something is not operating correctly. thanks C.

0 Karma


If you remove that search filter, do you see blank values in those additional rows for field Username and/or Hostname and/or Category and/or Status? A | search Status="*" is same as | where isnotnull(Status), to it removes any event where Status field is not available (is null), so you get lesser rows (which should be correct I would say).

0 Karma


search Status="*" will look for events where a field called Status exists. It will not return any events that do not contain a field called Status.

So it should be expected that these options will narrow your search, unless you expect that all of the fields you're naming in that search will be present in every event.

0 Karma


You also should move all those extra search criteria to the original search segment before the first pipe. Use parenthesis to group conditions appropriately.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...