Splunk Search

need to search for asterisk C asterisk in splunk

alexl1
Path Finder

hi, how do I search for asterisk C asterisk in splunk, in other words C

when I put that as the search criteria it returns all C's and things * is a wildcard. I tried backslash and double asterisk but those didn't work either. Thanks,

Tags (1)
0 Karma

linu1988
Champion

Hello,
Could you try this?

...|eval result=if(match(_raw," C "),"True","False")|...

OR

...|eval result=if(match(_raw,"\sC\s"),"True","False")|...

Thanks,
L

0 Karma

894859
Explorer

I use evals to search my * values as needed. As an example if you are searching against savedsearches, you will see the cron_schedule of a saved search which will most likely include asterisks. I would think this would also work in your situation:

| eval containsAsterisk=if(_raw LIKE "%C*%", "Yes", "No")
| search containsAsterisk=Yes

0 Karma

mahlerrd
Explorer

Markup fixes: that's backslash asterisk C backslash asterisk.

0 Karma

alexl1
Path Finder

yeah tried that, didn't help

0 Karma

mahlerrd
Explorer

I don't have any asterisks to confirm with, but have you tried working it around like the following?

 regex _raw="*" 

I believe you'll want, specifically, "*C*" but I'm not a regex expert. 😞

I found this here http://splunk-base.splunk.com/answers/13442/how-do-i-search-for-the-character

I_am_Jeff
Communicator

I found this. Might be helpful. "Search for * in log"
http://splunk-base.splunk.com/answers/34250/search-for-in-log

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...