Splunk Search

search question

laughterjj
New Member

In the search field, I entered: source=/logs/*/*.log it matches /logs/*/*.log and /logs/*/*/*.log. I need to see only the /logs/*/*.log entries and not the /logs/*/*/*.log entries. What should I change on the "search string" ? Thanks.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You're seeing log/*/*/*.log because Splunk interprets the wildcard "greedily", i.e. it will match as much as possible.

There is no way that I know of to make the wildcards non-greedy, but there are workarounds that you can use. One is to specify explicitly that you want sources that match /logs/*/*.log but not /logs/*/*/*.log:

source="/logs/*/*.log" AND NOT source="/logs/*/*/*.log"

Or you could use regex to filter results, like below.

source="/logs/*/*.log" | regex source="/logs/[^/]+/[^.]+\.log"

View solution in original post

0 Karma

Ayn
Legend

You're seeing log/*/*/*.log because Splunk interprets the wildcard "greedily", i.e. it will match as much as possible.

There is no way that I know of to make the wildcards non-greedy, but there are workarounds that you can use. One is to specify explicitly that you want sources that match /logs/*/*.log but not /logs/*/*/*.log:

source="/logs/*/*.log" AND NOT source="/logs/*/*/*.log"

Or you could use regex to filter results, like below.

source="/logs/*/*.log" | regex source="/logs/[^/]+/[^.]+\.log"
0 Karma

mzorzi
Splunk Employee
Splunk Employee

try: source="/logs//.log" NOT source="/logs///.log"

eventually with backslashes. But really you should avoid the wildcard in searches for performance reason

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...