Splunk Search

Wildcard search not producing accurate results



I am running a wild card search as i am using an input window (with the default value as a wildcard search that will produce everything). The issue is that even though all the values are set at * for wildcard when i remove these searches completely i get more events. So events are being lost and i am trying to figure out what.

sourcetype="test.csv"| eval Created=strftime(_time, "%d/%m/%Y %I:%M:%S %p")   |
search Username="*" AND Hostname="*" AND Category="*" | search Status="*" | search Username="*" AND Hostname="*" AND Category="*" | search Status="Closed" OR  Status="False Positive" | search UserAction="*"
|  table ISCM Category Created Priority UserAction Hostname Username Subject | sort by Created

I have completed a eval Created at the start of this as the input csv is indexing the updated time and i am changing this back. So the above search i get 410 events. But if i take out | search Status="*" | search Username="*" AND Hostname="*" AND Category="*" i get over 50 more entries which is confusing.

Anything else i can do as i need these search fields so the user can pick categories, usernames, hostnames and when they dont i just want everything but something is not operating correctly. thanks C.

0 Karma


If you remove that search filter, do you see blank values in those additional rows for field Username and/or Hostname and/or Category and/or Status? A | search Status="*" is same as | where isnotnull(Status), to it removes any event where Status field is not available (is null), so you get lesser rows (which should be correct I would say).

0 Karma


search Status="*" will look for events where a field called Status exists. It will not return any events that do not contain a field called Status.

So it should be expected that these options will narrow your search, unless you expect that all of the fields you're naming in that search will be present in every event.

0 Karma


You also should move all those extra search criteria to the original search segment before the first pipe. Use parenthesis to group conditions appropriately.

0 Karma
Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...