https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371160#M109233 <P>create a macro maybe?<BR /> (index = stuff-xxx OR index = stuff-yyy OR index = stuff-zzz OR index = stuff-xyz)<BR /> save it and name it as you please.<BR /> now search myMacro ... rest of search<BR /> docs article here:<BR /> <A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/Definesearchmacros">https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/Definesearchmacros</A><BR /> hope it helps</P> Mon, 26 Jun 2017 20:07:34 GMT adonio 2017-06-26T20:07:34Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371159#M109232 <P>Hi</P> <P>I have a search that needs to search in several indexes ending with several words, ex:</P> <PRE><CODE>index=stuff-xxx or index=stuff-yyy or index=stuff-zzz ... </CODE></PRE> <P>but these xxx, yyy and zzz 'words' are more than 20 and counting, so is there a way to do something like this?:</P> <PRE><CODE>index=stuff-(xxx|yyy|zzz) </CODE></PRE> <P>Note: do not suggest a star/asterisk wildcard, I need to ignore everything else, I don't need indexes like stuff-aaa.</P> <P>Thanks!</P> Mon, 26 Jun 2017 19:29:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371159#M109232 ribeiror 2017-06-26T19:29:44Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371160#M109233 <P>create a macro maybe?<BR /> (index = stuff-xxx OR index = stuff-yyy OR index = stuff-zzz OR index = stuff-xyz)<BR /> save it and name it as you please.<BR /> now search myMacro ... rest of search<BR /> docs article here:<BR /> <A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/Definesearchmacros">https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Knowledge/Definesearchmacros</A><BR /> hope it helps</P> Mon, 26 Jun 2017 20:07:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371160#M109233 adonio 2017-06-26T20:07:34Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371161#M109234 <P>Try like this</P> <PRE><CODE>[| gentimes start=-1 | eval index="xxx yyy zzz ppp qqq...all other separated by space" | table index | makemv index | mxpand index | eval index="stuff-".index ] ...rest of the search </CODE></PRE> <P>The subsearch will dynamically generate that OR list for you, so you just need to add the keyword in the <CODE>eval index="xxx...</CODE> part.</P> Mon, 26 Jun 2017 20:08:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371161#M109234 somesoni2 2017-06-26T20:08:31Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371162#M109235 <P>Yes, this way i can use the macro in several reports and stuff..<BR /> Thanks!</P> Fri, 30 Jun 2017 16:37:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371162#M109235 ribeiror 2017-06-30T16:37:19Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371163#M109236 <P>Try this </P> <P>eventtypes.conf</P> <P>[stuff_index]<BR /> search = index=stuff-xxx OR index=stuff-yyy ...</P> <P>Search query :<BR /> eventtype="stuff_index" .....</P> Fri, 30 Jun 2017 16:47:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-match-indexes-ending-with-a-set-of/m-p/371163#M109236 sbbadri 2017-06-30T16:47:38Z