https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352055#M104183 <P>The studying material says that -</P> <P>-- Wildcards in the middle of a string produce inconsistent results.</P> <P>Why is it?</P> Mon, 18 Dec 2017 18:31:25 GMT ddrillic 2017-12-18T18:31:25Z https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352055#M104183 <P>The studying material says that -</P> <P>-- Wildcards in the middle of a string produce inconsistent results.</P> <P>Why is it?</P> Mon, 18 Dec 2017 18:31:25 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352055#M104183 ddrillic 2017-12-18T18:31:25Z https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352056#M104184 <P>From which documentation is this?</P> Mon, 18 Dec 2017 19:08:14 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352056#M104184 somesoni2 2017-12-18T19:08:14Z https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352057#M104185 <P>I would say thats not correct at all.</P> <P>String matching is very predictable, and I frequently match all kinds of things with *'s in the middle.</P> <P>host=<EM>-uk-</EM>-* matches LIVE-uk-web-02 perfectly.<BR /> Never had any problem with it.</P> <P>Are you sure it didn't say <STRONG>"inefficient"</STRONG> - a query filled with wildcards is not as fast as something specifically defined</P> Mon, 18 Dec 2017 19:50:24 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352057#M104185 nickhills 2017-12-18T19:50:24Z https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352058#M104186 <P>Check out the Splunk .conf talk by Martin Mueller:</P> <P><A href="https://conf.splunk.com/files/2017/slides/fields-indexed-tokens-and-you.pdf">https://conf.splunk.com/files/2017/slides/fields-indexed-tokens-and-you.pdf</A></P> <P>Page 18 of 32.</P> Mon, 18 Dec 2017 19:50:42 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352058#M104186 micahkemp 2017-12-18T19:50:42Z https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352059#M104187 <P>From the *<EM>Splunk Fundamentals Part 2 (IOD) *</EM> course. </P> Mon, 18 Dec 2017 19:54:21 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352059#M104187 ddrillic 2017-12-18T19:54:21Z https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352060#M104188 <P>sounds like one for @martin_mueller to help with then <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 18 Dec 2017 20:03:05 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352060#M104188 nickhills 2017-12-18T20:03:05Z https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352061#M104189 <P>Here is Splunk's official word:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/Wildcards#Avoid_using_wildcards_in_the_middle_of_a_string">https://docs.splunk.com/Documentation/Splunk/latest/Search/Wildcards#Avoid_using_wildcards_in_the_middle_of_a_string</A></P> Thu, 23 Apr 2020 01:44:59 GMT https://community.splunk.com/t5/Splunk-Search/Why-do-wildcards-in-the-middle-of-a-string-produce-inconsistent/m-p/352061#M104189 woodcock 2020-04-23T01:44:59Z