field value *

Question

Hi,

I have a field named hello_world and a value of the field is *

I am writing a search where the results will not include this value *.

The problem is if I write for example: index=my_index NOT hello_world="*"

I will get no results that have any value for field hello_world and at face value that makes sense. So how can I tell Splunk to say NOT field=* (just the string/symbol) instead of NOT field=* (no results at all)

Accepted Answer

1

You may need to do something like this:

index=my_index | where NOT match(hello_world, "\*")

link

answered 09 Jun '11, 09:50

mw
1.7k●2●15
accept rate: 29%

1

You can also do simple string comparison in the where command:

... | where NOT hello_world="*"

(09 Jun '11, 09:53) ziegfried ♦

the match command works but it also seems to remove any other hello_world field values that contain an asterisk *. This could be a bit of a problem. Thanks mw. Ziegfried, your solution works as desired. Thanks again.

(10 Jun '11, 02:39) Ant1D

match uses regular expressions, so you just needed to anchor it then: "where NOT match(hello_world, "^\*$")"

(10 Jun '11, 03:10) mw

Answer 2

1

This is a known bug, which is present in the Release Notes' Known Issues page.

There is no way to escape an asterisk (*) in the search language. (SPL-30079)

So you should go for the suggested workarounds...

link

answered 09 Jun '11, 10:15

Paolo Prigione
2.0k●3●3●18
accept rate: 38%

I am good at finding Splunk bugs ;)

(10 Jun '11, 02:42) Ant1D

field value *

Follow this question

Splunk Resources

Related questions