Splunk Search
Highlighted

Wildcards on the left side of a comparison

Path Finder

Is there any way to use a wildcard on the left side of a comparison in a Splunk search? We have a scripted input that returns physical drive status across many systems, and the results look like this:

hostname=some_hostname physDrv1=ok physDrv2=ok physDrv3=ok physDrv4=failed

Is there any way to search for events that have any non-OK lines like below? This apparently doesn't work and I haven't found anything in the Splunk documentation.

sourcetype=drive_status | where physDrv*!="ok"

For now, we just hardcode every possible drive property in the search like below and it works fine, but it would be cool to write a more elegant search if possible. Let me know what you think. Thanks for the help!

sourcetype=drive_status | where physDrv1!="ok" OR physDrv2!="ok" OR physDrv3!="ok" OR physDrv4!="ok"
Tags (2)
0 Karma
Highlighted

Re: Wildcards on the left side of a comparison

Super Champion

You could try:

sourcetype=drive_status NOT "ok" | your stats or table

But you have to be careful how you use it because it will ignore "ok" regardless of the field. In your example, it looks like ignoring "ok" will not be a problem.

0 Karma
Highlighted

Re: Wildcards on the left side of a comparison

Path Finder

Cool, thanks for the feedback. I'm not sure if this will work though, as it looks like this filters out all events that have the text "ok" anywhere in them.

I gave it a shot and it filters out all results which obviously isn't what we want. Thanks for the suggestion though!

0 Karma
Highlighted

Re: Wildcards on the left side of a comparison

SplunkTrust
SplunkTrust

Try following

index=blah sourcetype=blah NOT "physDrv*=ok" | <do more>

UPDATED Search

Try this

index=blah sourcetype=blah | rex max_match=0 "(?m)physDrv[0-9]*=(?<drive_status>[^ ]+)" | nomv drive_status | eval drive_status=replace(drive_status,"ok","") | where drive_status!=""

View solution in original post

Highlighted

Re: Wildcards on the left side of a comparison

Path Finder

Hmmm, no dice here either. This filters out all events that an OK in any of the drives/properties, similar to the above suggestion.

0 Karma
Highlighted

Re: Wildcards on the left side of a comparison

SplunkTrust
SplunkTrust

Please see if the updated answer works.

0 Karma
Highlighted

Re: Wildcards on the left side of a comparison

Path Finder

Perfect, works like a treat! I had to modify the above slightly (see below), but this is otherwise exactly what I needed. Thanks a ton!

rex maxmatch=0 "(?m)physDrv[0-9]+=(?<drivestatus>[\w]+)" | nomv drivestatus | eval drivestatus=replace(drivestatus,"ok\s*","") | where drivestatus!=""