hi, how do I search for asterisk C asterisk in splunk, in other words C
when I put that as the search criteria it returns all C's and things * is a wildcard. I tried backslash and double asterisk but those didn't work either. Thanks,
Hello,
Could you try this?
...|eval result=if(match(_raw," C "),"True","False")|...
OR
...|eval result=if(match(_raw,"\sC\s"),"True","False")|...
Thanks,
L
I use evals to search my * values as needed. As an example if you are searching against savedsearches, you will see the cron_schedule of a saved search which will most likely include asterisks. I would think this would also work in your situation:
| eval containsAsterisk=if(_raw LIKE "%C*%", "Yes", "No")
| search containsAsterisk=Yes
Markup fixes: that's backslash asterisk C backslash asterisk.
yeah tried that, didn't help
I don't have any asterisks to confirm with, but have you tried working it around like the following?
regex _raw="*"
I found this here http://splunk-base.splunk.com/answers/13442/how-do-i-search-for-the-character
I found this. Might be helpful. "Search for * in log"
http://splunk-base.splunk.com/answers/34250/search-for-in-log