Splunk Search

Wildcards on the left side of a comparison

jerdmann
Path Finder

Is there any way to use a wildcard on the left side of a comparison in a Splunk search? We have a scripted input that returns physical drive status across many systems, and the results look like this:

hostname=some_hostname physDrv1=ok physDrv2=ok physDrv3=ok physDrv4=failed

Is there any way to search for events that have any non-OK lines like below? This apparently doesn't work and I haven't found anything in the Splunk documentation.

sourcetype=drive_status | where physDrv*!="ok"

For now, we just hardcode every possible drive property in the search like below and it works fine, but it would be cool to write a more elegant search if possible. Let me know what you think. Thanks for the help!

sourcetype=drive_status | where physDrv1!="ok" OR physDrv2!="ok" OR physDrv3!="ok" OR physDrv4!="ok"
Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try following

index=blah sourcetype=blah NOT "physDrv*=ok" | <do more>

UPDATED Search

Try this

index=blah sourcetype=blah | rex max_match=0 "(?m)physDrv[0-9]*=(?<drive_status>[^ ]+)" | nomv drive_status | eval drive_status=replace(drive_status,"ok","") | where drive_status!=""

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try following

index=blah sourcetype=blah NOT "physDrv*=ok" | <do more>

UPDATED Search

Try this

index=blah sourcetype=blah | rex max_match=0 "(?m)physDrv[0-9]*=(?<drive_status>[^ ]+)" | nomv drive_status | eval drive_status=replace(drive_status,"ok","") | where drive_status!=""

jerdmann
Path Finder

Perfect, works like a treat! I had to modify the above slightly (see below), but this is otherwise exactly what I needed. Thanks a ton!

rex max_match=0 "(?m)physDrv[0-9]+=(?[\w]+)" | nomv drive_status | eval drive_status=replace(drive_status,"ok\s*","") | where drive_status!=""

somesoni2
SplunkTrust
SplunkTrust

Please see if the updated answer works.

0 Karma

jerdmann
Path Finder

Hmmm, no dice here either. This filters out all events that an OK in any of the drives/properties, similar to the above suggestion.

0 Karma

lukejadamec
Super Champion

You could try:

sourcetype=drive_status NOT "ok" | your stats or table

But you have to be careful how you use it because it will ignore "ok" regardless of the field. In your example, it looks like ignoring "ok" will not be a problem.

0 Karma

jerdmann
Path Finder

Cool, thanks for the feedback. I'm not sure if this will work though, as it looks like this filters out all events that have the text "ok" anywhere in them.

I gave it a shot and it filters out all results which obviously isn't what we want. Thanks for the suggestion though!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...