Splunk Search

need to search for asterisk C asterisk in splunk

alexl1
Path Finder

hi, how do I search for asterisk C asterisk in splunk, in other words C

when I put that as the search criteria it returns all C's and things * is a wildcard. I tried backslash and double asterisk but those didn't work either. Thanks,

Tags (1)
0 Karma

linu1988
Champion

Hello,
Could you try this?

...|eval result=if(match(_raw," C "),"True","False")|...

OR

...|eval result=if(match(_raw,"\sC\s"),"True","False")|...

Thanks,
L

0 Karma

894859
Explorer

I use evals to search my * values as needed. As an example if you are searching against savedsearches, you will see the cron_schedule of a saved search which will most likely include asterisks. I would think this would also work in your situation:

| eval containsAsterisk=if(_raw LIKE "%C*%", "Yes", "No")
| search containsAsterisk=Yes

0 Karma

mahlerrd
Explorer

Markup fixes: that's backslash asterisk C backslash asterisk.

0 Karma

alexl1
Path Finder

yeah tried that, didn't help

0 Karma

mahlerrd
Explorer

I don't have any asterisks to confirm with, but have you tried working it around like the following?

 regex _raw="*" 

I believe you'll want, specifically, "*C*" but I'm not a regex expert. 😞

I found this here http://splunk-base.splunk.com/answers/13442/how-do-i-search-for-the-character

I_am_Jeff
Communicator

I found this. Might be helpful. "Search for * in log"
http://splunk-base.splunk.com/answers/34250/search-for-in-log

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...