Splunk Search

Is there a way to only search * (asterisk)?

abhaybhagat08
New Member

Dear Experts ,

Please suggest an answer on a silly question

If my log contains *(star) as a word/character .

How we will be able to do it in Splunk .
As in Splunk * is considered as regex .

Is it possible.

Regards,
Abhay

0 Karma

nembela
Path Finder

According to the documentation the "where" or "regex" command should be used: https://docs.splunk.com/Documentation/Splunk/latest/Search/Wildcards#Searching_for_the_asterisk_char...

 

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can do like this

your base search | regex _raw=".*\*.*"
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

or | search match(_raw,"[*]")

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The match function is not available with | search command. Do you mean | where match(_raw,"[*]") (which works)?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...