Splunk Search

How do I search for a string with a partial portion of the string?

ptur
Path Finder

Can someone help explain why "partial" search doesn't work for me?

It's an ASA syslog... when I search for a full syslog event "%ASA-4-713903" it finds it, when i search "%ASA-4-" the "%ASA-4-713903" is among the results, but when I search ""%ASA-4-71390" it finds nothing.

Thanks!

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Add an asterisk to the end:

"%ASA-4-71390*"

I does full words only if you don't add the asterisk.

View solution in original post

0 Karma

ptur
Path Finder

Thanks for both answers!

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @ptur, if @somesoni2 or @cpetterborg solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

For understand that behavior, you need to understand how Splunk stores the data in Splunk for text based searching. The phenomenon I'm referring to is 'Event Segmentation' and you can find all you need here:http://docs.splunk.com/Documentation/Splunk/6.6.2/Data/Abouteventsegmentation

cpetterborg
SplunkTrust
SplunkTrust

Add an asterisk to the end:

"%ASA-4-71390*"

I does full words only if you don't add the asterisk.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...