topic Use wildcard in source? in Splunk Search

Use wildcard in source?

nishantjiit — Thu, 09 Nov 2017 09:12:25 GMT

I have a directory C:\logs

in this directory I have multiple files:

1: logging-projectname-0.log (There can be multiple files like *-1.log, *-2.log etc..)
2: logging-projectname-batch-0.log (There can be multiple files like *batch-1.log, *batch-2.log etc..)

I only want to search the files like #1. So, I tried ---- source="c:\logs\logging-projectname-[0-9]{1,}.log" SEARCH_STRING

It's not working. Can anyone suggest?

Thanks in advance.

Re: Use wildcard in source?

skalliger — Thu, 09 Nov 2017 10:18:36 GMT

Why don't you just use a wildcard like you mentioned it yourself?
Nevermind that.

Skalli

edit: deleted my search string.

Re: Use wildcard in source?

somesoni2 — Thu, 09 Nov 2017 11:52:16 GMT

Another option would be this

your base search | regex source="c:\\\\logs\\\\logging-projectname-\d+\.log"

Re: Use wildcard in source?

xavierashe — Thu, 09 Nov 2017 13:06:59 GMT

This should be an OR, not an AND.

Re: Use wildcard in source?

skalliger — Thu, 09 Nov 2017 13:08:45 GMT

Oh, you're correct. I've misread that. Thought he wants only one but not the other one.

I'll edit it.

Re: Use wildcard in source?

richgalloway — Thu, 09 Nov 2017 13:56:28 GMT

source uses wildcards, not regular expressions. somesoni2's suggestion should work.

Re: Use wildcard in source?

nishantjiit — Thu, 09 Nov 2017 16:51:06 GMT

Thanks it worked

Re: Use wildcard in source?

richgalloway — Thu, 09 Nov 2017 21:29:41 GMT

@nishantjiit, please accept an answer.

Re: Use wildcard in source?

horsefez — Fri, 10 Nov 2017 10:50:26 GMT

@skalliger
stop being a noob 😛 😄

Re: Use wildcard in source?

skalliger — Fri, 10 Nov 2017 12:18:36 GMT

Should have deleted my comment. 😄