Splunk Search

escaping hyphen if any field has hyphen(-) as value

thambisetty
SplunkTrust
SplunkTrust

Hi
I have data like below in the Active Directory.

Account Name

-
L-15485
D-5486
BLR-DC-09$

Here is my query;
| search "Account Name"="-"

showing Output:

BLR-DC-09$

but actual output to be expected:

L-15485
D-5486
BLR-DC-09$

Note: I read splunk document for -(hyphen) it says - for match any character.
Now my question is how to escape that one as it works.

————————————
If this helps, give a like below.
Tags (1)
0 Karma

linu1988
Champion

Hello,
you need the where clause.

...|where "Account Name" like "%-%-%"

Thanks,
L

0 Karma

ewelch_splunk
Splunk Employee
Splunk Employee

My use case was a little different, I was trying to remove Account_Name = "-" from sourcetype = ActiveDirectory, and the where clause was the only method that I could find that produced the results I needed. Thanks!

0 Karma

aweitzman
Motivator

I'm not sure where you read that hyphen matches any character in Splunk. Could you please provide a link to where it says that? I can't think of a circumstance where it does, especially inside quotes.

I don't think I understand what you mean by "escape." Are you trying to write a search that returns all rows except the ones where the Account Name field has just a hyphen in it? And if so, does:

"Account Name"!="-"

not work? If not, how about:

"Account Name"!="\-"

What does that get you?

0 Karma

thambisetty
SplunkTrust
SplunkTrust

for hyphen?

————————————
If this helps, give a like below.
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try | search "Account Name"="*"

0 Karma

yannK
Splunk Employee
Splunk Employee

have you tried :

| search "Account Name"="*-*"

0 Karma

thambisetty
SplunkTrust
SplunkTrust

I tried that one by that also im getting only BLR-DC-09$
I want to remove only - values from that field.
your query is wrong..

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...