Is there any way to use a wildcard on the left side of a comparison in a Splunk search? We have a scripted input that returns physical drive status across many systems, and the results look like this:
hostname=some_hostname physDrv1=ok physDrv2=ok physDrv3=ok physDrv4=failed
Is there any way to search for events that have any non-OK lines like below? This apparently doesn't work and I haven't found anything in the Splunk documentation.
sourcetype=drive_status | where physDrv*!="ok"
For now, we just hardcode every possible drive property in the search like below and it works fine, but it would be cool to write a more elegant search if possible. Let me know what you think. Thanks for the help!
sourcetype=drive_status | where physDrv1!="ok" OR physDrv2!="ok" OR physDrv3!="ok" OR physDrv4!="ok"
You could try:
sourcetype=drive_status NOT "ok" | your stats or table
But you have to be careful how you use it because it will ignore "ok" regardless of the field. In your example, it looks like ignoring "ok" will not be a problem.
Cool, thanks for the feedback. I'm not sure if this will work though, as it looks like this filters out all events that have the text "ok" anywhere in them.
I gave it a shot and it filters out all results which obviously isn't what we want. Thanks for the suggestion though!
index=blah sourcetype=blah NOT "physDrv*=ok" | <do more>
index=blah sourcetype=blah | rex max_match=0 "(?m)physDrv[0-9]*=(?<drive_status>[^ ]+)" | nomv drive_status | eval drive_status=replace(drive_status,"ok","") | where drive_status!=""
Hmmm, no dice here either. This filters out all events that an OK in any of the drives/properties, similar to the above suggestion.
Perfect, works like a treat! I had to modify the above slightly (see below), but this is otherwise exactly what I needed. Thanks a ton!
rex maxmatch=0 "(?m)physDrv[0-9]+=(?<drivestatus>[\w]+)" | nomv drivestatus | eval drivestatus=replace(drivestatus,"ok\s*","") | where drivestatus!=""