Splunk Search

Wildcard search not producing accurate results



I am running a wild card search as i am using an input window (with the default value as a wildcard search that will produce everything). The issue is that even though all the values are set at * for wildcard when i remove these searches completely i get more events. So events are being lost and i am trying to figure out what.

sourcetype="test.csv"| eval Created=strftime(_time, "%d/%m/%Y %I:%M:%S %p")   |
search Username="*" AND Hostname="*" AND Category="*" | search Status="*" | search Username="*" AND Hostname="*" AND Category="*" | search Status="Closed" OR  Status="False Positive" | search UserAction="*"
|  table ISCM Category Created Priority UserAction Hostname Username Subject | sort by Created

I have completed a eval Created at the start of this as the input csv is indexing the updated time and i am changing this back. So the above search i get 410 events. But if i take out | search Status="*" | search Username="*" AND Hostname="*" AND Category="*" i get over 50 more entries which is confusing.

Anything else i can do as i need these search fields so the user can pick categories, usernames, hostnames and when they dont i just want everything but something is not operating correctly. thanks C.

0 Karma

Revered Legend

If you remove that search filter, do you see blank values in those additional rows for field Username and/or Hostname and/or Category and/or Status? A | search Status="*" is same as | where isnotnull(Status), to it removes any event where Status field is not available (is null), so you get lesser rows (which should be correct I would say).

0 Karma


search Status="*" will look for events where a field called Status exists. It will not return any events that do not contain a field called Status.

So it should be expected that these options will narrow your search, unless you expect that all of the fields you're naming in that search will be present in every event.

0 Karma


You also should move all those extra search criteria to the original search segment before the first pipe. Use parenthesis to group conditions appropriately.

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...