is * supported?

[riderofyamaha]

Is the wildcard search star * supported by logs in splunk? Im trying to see if splunk is seeing changes being made in log files..

[simuvid]

Splunk supports the asterisk (*) wildcard for searching. Searching for * by itself means "match all" and returns all events. Searching for * as part of a word matches based on that word: for example fail* matches fail, failure, and failures. See also:

http://www.splunk.com/base/Documentation/4.1.3/User/Startsearchingtutorial#Search_with_wildcards

I am not sure which changes you try to identify, but you can use fschange to detect chages in files.

See also:

http://www.splunk.com/base/Documentation/4.1.3/Admin/Monitorchangestoyourfilesystem

Hope that answers your question?

Cheers,

Christian

[riderofyamaha]

yeah, that helps, thanks alot

[Lowell]

BTW, searching for a literal '' in your search is not currently supported (unless you disable '' as a wildcard)