Hello everyone, I'm a beginner in using Splunk. I'm facing an issue in finding a search solution for the following idea: I'm logging the deletion behavior of files, and I have whitelisted some import...
I have a search that uses some wildcards:
sourcetype="EPPWEB" source="/opt/log/*/web_server/info.log" WAT
| rex field=_raw "USER (?P<registrar>\[\d+-\w\w\]) downloading .*/(?<filename&g...
Hi, I'm trying to get wildcard lookups to work using the "lookup" function. I've followed guidance to set up the "Match Type" for the fieldin the lookup definition as per Define a CSV lookup in S...
Hi,
I have a dropdown that lists individual values (example, 1,2,3,4,5) with a token num. The query looks like this
index=blah numberfield="$num$"
And that works just fine
What I'd like ...
I need some help on the syntax of wildcards in the search. I have multiple servers and I don't want to keep using OR. For example I have "server01" through "server21" and I sometimes want to just p...
I'm trying to use wildcards in a lookup file and am not able to get them working. I have referenced other posted answers but am not having success. Steps I have taken:
Created a lookup file c...
I have log files coming in from a Windows Server and file I can receive the required files when I specify the specific filename however I need to use a wildcard and it does not seem to be working....
Hello,
I am using splunk 9.0.0.1, and running btool to list out my index settings. The trouble is I only want one stanza, but btool treats the stanza as a wildcard.
splunk btool&n...
Im trying to set a boolean based on a match in a string.
I want to set a value to 1 if it does not match ingestion* and set it to 0 if it does match.
The following example shows the problem:
...
How can I use predict command with wildcard, as I have timechart with group by field. See below example query.
Query: index=_internal sourcetype=splunkd* | timechart count as Count by s...