Splunk Search
Highlighted

is * supported?

Explorer

Is the wildcard search star * supported by logs in splunk? Im trying to see if splunk is seeing changes being made in log files..

Tags (1)
0 Karma
Highlighted

Re: is * supported?

Splunk Employee
Splunk Employee

Splunk supports the asterisk (*) wildcard for searching. Searching for * by itself means "match all" and returns all events. Searching for * as part of a word matches based on that word: for example fail* matches fail, failure, and failures. See also:

http://www.splunk.com/base/Documentation/4.1.3/User/Startsearchingtutorial#Search_with_wildcards

I am not sure which changes you try to identify, but you can use fschange to detect chages in files.

See also:

http://www.splunk.com/base/Documentation/4.1.3/Admin/Monitorchangestoyourfilesystem

Hope that answers your question?

Cheers,

Christian

Highlighted

Re: is * supported?

Super Champion

BTW, searching for a literal '' in your search is not currently supported (unless you disable '' as a wildcard)

Highlighted

Re: is * supported?

Explorer

yeah, that helps, thanks alot

0 Karma