Splunk Search

exclude asterisk character from a search

SplunkTrust
SplunkTrust

Hi at all,
I have a field (called uid) with some values = "*" and I'd like to exclude them from the results of my search.
I tried with uid="*" but Splunk read asterisk as a wildcard.
How can I do this?
Thanks in advance.
Giuseppe

0 Karma
1 Solution

Esteemed Legend

The base SPL always treats asterisk as wildcard and it cannot be escaped. However, there are several ways to do this by piping to where, such as like or match (you could also pipe to regex😞

... | where NOT match(uid, "\*")

View solution in original post

Motivator

Hi cusello
Try this search code

......|table uid |where isnotnull(uid)

Look at an example

sourcetype=access_* |table  categoryId |where isnotnull(categoryId) 

It works well

0 Karma

Esteemed Legend

The base SPL always treats asterisk as wildcard and it cannot be escaped. However, there are several ways to do this by piping to where, such as like or match (you could also pipe to regex😞

... | where NOT match(uid, "\*")

View solution in original post

Communicator

Why dont you Try with where command it will work

..|where uid=="*"

Communicator

Here you can use NOT operator along with where to exclude.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!