Is the wildcard search star * supported by logs in splunk? Im trying to see if splunk is seeing changes being made in log files..
Splunk supports the asterisk (*) wildcard for searching. Searching for * by itself means "match all" and returns all events. Searching for * as part of a word matches based on that word: for example fail* matches fail, failure, and failures. See also:
http://www.splunk.com/base/Documentation/4.1.3/User/Startsearchingtutorial#Search_with_wildcards
I am not sure which changes you try to identify, but you can use fschange to detect chages in files.
See also:
http://www.splunk.com/base/Documentation/4.1.3/Admin/Monitorchangestoyourfilesystem
Hope that answers your question?
Cheers,
Christian
yeah, that helps, thanks alot
BTW, searching for a literal '' in your search is not currently supported (unless you disable '' as a wildcard)