search for all fields which have some string in field
up vote
0
down vote
favorite
How can I get only results for specific fields where field name is like something ?
fx.
get all fields which have "status" in their field name.
I tried this but It doesnt work:
sta*
I want also to do later this:
sta* OR STA* OR Sta*
splunk splunk-query
asked Nov 8 at 8:33
aalb2993
11
New contributor
aalb2993 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
up vote
0
down vote
favorite
How can I get only results for specific fields where field name is like something ?
fx.
get all fields which have "status" in their field name.
I tried this but It doesnt work:
sta*
I want also to do later this:
sta* OR STA* OR Sta*
splunk splunk-query
asked Nov 8 at 8:33
aalb2993
11
New contributor
aalb2993 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Hi there, please look at this guide how to ask good questions. Some formatting as Code might already be enough to make your question good enough.
– Jan
Nov 8 at 8:45
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
How can I get only results for specific fields where field name is like something ?
fx.
get all fields which have "status" in their field name.
I tried this but It doesnt work:
sta*
I want also to do later this:
sta* OR STA* OR Sta*
splunk splunk-query
asked Nov 8 at 8:33
aalb2993
11
New contributor
aalb2993 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
How can I get only results for specific fields where field name is like something ?
fx.
get all fields which have "status" in their field name.
I tried this but It doesnt work:
sta*
I want also to do later this:
sta* OR STA* OR Sta*
splunk splunk-query
splunk splunk-query
asked Nov 8 at 8:33
aalb2993
11
New contributor
aalb2993 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Nov 8 at 8:33
aalb2993
11
New contributor
aalb2993 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
edited Nov 8 at 9:33
asked Nov 8 at 8:33
aalb2993
11
New contributor
aalb2993 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked Nov 8 at 8:33
aalb2993
11
asked Nov 8 at 8:33
aalb2993
11
11
New contributor
aalb2993 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
aalb2993 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
aalb2993 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Hi there, please look at this guide how to ask good questions. Some formatting as Code might already be enough to make your question good enough.
– Jan
Nov 8 at 8:45
add a comment |
Hi there, please look at this guide how to ask good questions. Some formatting as Code might already be enough to make your question good enough.
– Jan
Nov 8 at 8:45
Hi there, please look at this guide how to ask good questions. Some formatting as Code might already be enough to make your question good enough.
– Jan
Nov 8 at 8:45
Hi there, please look at this guide how to ask good questions. Some formatting as Code might already be enough to make your question good enough.
– Jan
Nov 8 at 8:45
add a comment |
1 Answer
1
active
oldest
votes
up vote
0
down vote
Entering just "status" in the search box may not be enough. It depends on what your default indexes are and where the data is. By default, the default index is 'main', but your admins may have put the data in different indexes. Using index=* status for a 15-minute search should tell you which index holds the data. Then you can specify it in your subsequent searches.
answered Nov 8 at 11:33
RichG
48138
add a comment |
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
0
down vote
Entering just "status" in the search box may not be enough. It depends on what your default indexes are and where the data is. By default, the default index is 'main', but your admins may have put the data in different indexes. Using index=* status for a 15-minute search should tell you which index holds the data. Then you can specify it in your subsequent searches.
answered Nov 8 at 11:33
RichG
48138
add a comment |
up vote
0
down vote
Entering just "status" in the search box may not be enough. It depends on what your default indexes are and where the data is. By default, the default index is 'main', but your admins may have put the data in different indexes. Using index=* status for a 15-minute search should tell you which index holds the data. Then you can specify it in your subsequent searches.
answered Nov 8 at 11:33
RichG
48138
add a comment |
up vote
0
down vote
up vote
0
down vote
Entering just "status" in the search box may not be enough. It depends on what your default indexes are and where the data is. By default, the default index is 'main', but your admins may have put the data in different indexes. Using index=* status for a 15-minute search should tell you which index holds the data. Then you can specify it in your subsequent searches.
answered Nov 8 at 11:33
RichG
48138
Entering just "status" in the search box may not be enough. It depends on what your default indexes are and where the data is. By default, the default index is 'main', but your admins may have put the data in different indexes. Using index=* status for a 15-minute search should tell you which index holds the data. Then you can specify it in your subsequent searches.
answered Nov 8 at 11:33
RichG
48138
answered Nov 8 at 11:33
RichG
48138
answered Nov 8 at 11:33
RichG
48138
answered Nov 8 at 11:33
RichG
48138
48138
add a comment |
add a comment |
aalb2993 is a new contributor. Be nice, and check out our Code of Conduct.
aalb2993 is a new contributor. Be nice, and check out our Code of Conduct.
aalb2993 is a new contributor. Be nice, and check out our Code of Conduct.
aalb2993 is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53203991%2fsearch-for-all-fields-which-have-some-string-in-field%23new-answer', 'question_page');
}
);
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Hi there, please look at this guide how to ask good questions. Some formatting as Code might already be enough to make your question good enough.
– Jan
Nov 8 at 8:45