Monitoring Splunk

behavior of a "*"

daktapaal
Path Finder

Hi all,

I wanted to know the behavior of *.
When I do index = *, does it get me all the indexes?

I have the following happening.

When I do index = _*, i get two indexes called _aaaindex and _bbbindex.

but when I do index = *, i do not see these indexes (_aaaindex and _bbbindex. ) there.. I would have thought index = * is a super set and it will bring everything back? including ( _* )..

Tags (2)
0 Karma

kristian_kolb
Ultra Champion

Well, indexes whose names start with an underscore, are considered internal, and are not listed unless you explicitly make it so, either by searching for;

index=* OR index=_*

OR

you include the "All Internal indexes" to the set of indexes that are searched by default for your role. Actually, you don't have include "all internal indexes", you pick and choose, just like with normal indexes.


EDIT: lukejadamec is also right, even though this was not part of the question. In regular expressions, the asterisk is a quantifier that means that the preceding group or character can be present zero or more times.7

As part of a search query, it behaves pretty much like wildcards in the file system (or like the .* regex)

/K

0 Karma

lukejadamec
Super Champion

The * in a search will always mean the wildcard any number of any character, it cannot be escaped. If you search for nothing, then you should get an error because the search term is missing.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...