Splunk Search

need to search for asterisk C asterisk in splunk

alexl1
Path Finder

hi, how do I search for asterisk C asterisk in splunk, in other words C

when I put that as the search criteria it returns all C's and things * is a wildcard. I tried backslash and double asterisk but those didn't work either. Thanks,

Tags (1)
0 Karma

linu1988
Champion

Hello,
Could you try this?

...|eval result=if(match(_raw," C "),"True","False")|...

OR

...|eval result=if(match(_raw,"\sC\s"),"True","False")|...

Thanks,
L

0 Karma

894859
Explorer

I use evals to search my * values as needed. As an example if you are searching against savedsearches, you will see the cron_schedule of a saved search which will most likely include asterisks. I would think this would also work in your situation:

| eval containsAsterisk=if(_raw LIKE "%C*%", "Yes", "No")
| search containsAsterisk=Yes

0 Karma

mahlerrd
Explorer

Markup fixes: that's backslash asterisk C backslash asterisk.

0 Karma

alexl1
Path Finder

yeah tried that, didn't help

0 Karma

mahlerrd
Explorer

I don't have any asterisks to confirm with, but have you tried working it around like the following?

 regex _raw="*" 

I believe you'll want, specifically, "*C*" but I'm not a regex expert. 😞

I found this here http://splunk-base.splunk.com/answers/13442/how-do-i-search-for-the-character

I_am_Jeff
Communicator

I found this. Might be helpful. "Search for * in log"
http://splunk-base.splunk.com/answers/34250/search-for-in-log

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...