Splunk Search

See all results that match a portion of a field?

kbcuait
Explorer

Hi, is it possible to broaden a search with something like this:

| dbquery "dbname" "SELECT fieldname_(*) FROM tablename"

Where the fieldname_ has multiple variations such as fielname_1, fieldname_2, fieldname_3, etc.

Would like to take a look at a glance what is in all of these fields

Thanks 🙂

Tags (3)
0 Karma

stefandagerman
Path Finder

What you could do in that case is to query the database catalog tables for the table you are interested in and get a list of the columns that are defined for that table. Depends on the RDBMS you are using, for DB2, for example, it's something like: "SELECT * from SYSIBM.SYSCOLUMNS where schema="foo" and table="bar".

That would give you the names (and attributes) of all columns for the table. You could easily filter by adding " AND name LIKE "field name_%" if you only want to see the column names that follow a given pattern.

0 Karma

stefandagerman
Path Finder
0 Karma

stefandagerman
Path Finder

As asked, this is really a SQL question and I think the answer in that case is no, I don't think you can use wildcards in database columns. But I think I may be misunderstanding the question.
Can you tell us a bit more of what exactly you are trying to do?

0 Karma

kbcuait
Explorer

Hi yes - wanting to use wildcards in columns. Thank appreciate your answer. Have a number of rather cryptic column names and new with this db, was hoping to use Splunk in this case to get a quick feel for what is in them... If need be I will just click through DB Info pages. Thanks for your response

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...