https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397319#M6778 <P>try</P> <PRE><CODE> index=DBG_SYS sourcetype=DBG_SYS msg="Shelf 1 congestion, resource cps level 2." | append [| search index=DBG_SYS sourcetype=DBG_SYS | regex msg="Shelf 1 slot\s(\d{1,2})\scongestion, resource cpu level\s(\d{1,2})" ] | rex field=msg "cpu level+\s(?&lt;level&gt;\d+)" | rex field=msg "cps level+\s(?&lt;level&gt;\d+)" | where level&gt;0 | eval local_date_hour=strftime(_time,"%H") | stats by local_date_hour host msg | table local_date_hour host msg count(code) | rename count(code) as hits | rename local_date_hour as Hour | sort by Hour </CODE></PRE> Fri, 11 Jan 2019 22:30:43 GMT vnravikumar 2019-01-11T22:30:43Z https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397315#M6774 <P><CODE>search index=DBG_SYS sourcetype=DBG_SYS msg="Shelf 1 congestion, resource cps level 2." OR msg="Shelf 1 slot * congestion, resource cpu level *"</CODE></P> <P>I have a search that works, but I am getting warnings about having Wildcards in the middle of a string.<BR /> Not sure how to avoid this since Slot numbers can be 0-99 and the level can be 0-99 also.<BR /> Is it possible to look for <BR /> Shelf 1 slot (any integer) congestion, resource cpu level (any integer)</P> Fri, 11 Jan 2019 21:03:49 GMT https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397315#M6774 jamesfdally 2019-01-11T21:03:49Z https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397316#M6775 <P>Hi @jamesfdally</P> <P>Try like</P> <PRE><CODE>|regex msg="Shelf 1 slot\s(\d{1,2})\scongestion, resource cpu level\s(\d{1,2})" </CODE></PRE> Fri, 11 Jan 2019 21:33:35 GMT https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397316#M6775 vnravikumar 2019-01-11T21:33:35Z https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397317#M6776 <P>I do not understand where I should put this. Should I keep my original search and add this? Then I will still get the same warning on my scheduled search every day. I have an OR statement in my search also so I need more information please.</P> Fri, 11 Jan 2019 21:59:41 GMT https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397317#M6776 jamesfdally 2019-01-11T21:59:41Z https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397318#M6777 <PRE><CODE>index=DBG_SYS sourcetype=DBG_SYS msg="Shelf 1 congestion, resource cps level 2." OR msg="Shelf 1 slot * congestion, resource cpu level *" | rex field=msg "cpu level+\s(?&lt;level&gt;\d+)" | rex field=msg "cps level+\s(?&lt;level&gt;\d+)" | where level&gt;0 | eval local_date_hour=strftime(_time,"%H") | stats by local_date_hour host msg | table local_date_hour host msg count(code) | rename count(code) as hits ] | rename local_date_hour as Hour | sort by Hour </CODE></PRE> Fri, 11 Jan 2019 22:03:08 GMT https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397318#M6777 jamesfdally 2019-01-11T22:03:08Z https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397319#M6778 <P>try</P> <PRE><CODE> index=DBG_SYS sourcetype=DBG_SYS msg="Shelf 1 congestion, resource cps level 2." | append [| search index=DBG_SYS sourcetype=DBG_SYS | regex msg="Shelf 1 slot\s(\d{1,2})\scongestion, resource cpu level\s(\d{1,2})" ] | rex field=msg "cpu level+\s(?&lt;level&gt;\d+)" | rex field=msg "cps level+\s(?&lt;level&gt;\d+)" | where level&gt;0 | eval local_date_hour=strftime(_time,"%H") | stats by local_date_hour host msg | table local_date_hour host msg count(code) | rename count(code) as hits | rename local_date_hour as Hour | sort by Hour </CODE></PRE> Fri, 11 Jan 2019 22:30:43 GMT https://community.splunk.com/t5/Splunk-Dev/Wildcards-in-the-middle-and-end-of-a-string/m-p/397319#M6778 vnravikumar 2019-01-11T22:30:43Z