https://community.splunk.com/t5/Splunk-Search/Does-IN-support-wildcards/m-p/419538#M120627 <P>@danielbb yes it should so if it is not working then please add more details as to what you are trying to do and what is your current data/SPL (mock/anonymize any sensitive information before posting on Splunk Answers).</P> <P>Meanwhile based on the code/data snippet provided in the question, try the following run anywhere example search:</P> <PRE><CODE>| makeresults | fields - _time | eval hostname="test1.domain1.com,test2.domain1.com,test3.domain2.com,test4.domain3.com" | makemv hostname delim="," | mvexpand hostname | search NOT hostname IN ("*.domain1.com", "*.domain2.com") </CODE></PRE> Wed, 31 Jul 2019 17:12:55 GMT niketn 2019-07-31T17:12:55Z https://community.splunk.com/t5/Splunk-Search/Does-IN-support-wildcards/m-p/419537#M120626 <P>The following doesn't seem to work -</P> <PRE><CODE>NOT hostname IN ("*.&lt;domain1&gt;.com", "*.&lt;domain2&gt;.com") </CODE></PRE> <P>Does IN support wildcards?</P> Wed, 31 Jul 2019 16:42:42 GMT https://community.splunk.com/t5/Splunk-Search/Does-IN-support-wildcards/m-p/419537#M120626 danielbb 2019-07-31T16:42:42Z https://community.splunk.com/t5/Splunk-Search/Does-IN-support-wildcards/m-p/419538#M120627 <P>@danielbb yes it should so if it is not working then please add more details as to what you are trying to do and what is your current data/SPL (mock/anonymize any sensitive information before posting on Splunk Answers).</P> <P>Meanwhile based on the code/data snippet provided in the question, try the following run anywhere example search:</P> <PRE><CODE>| makeresults | fields - _time | eval hostname="test1.domain1.com,test2.domain1.com,test3.domain2.com,test4.domain3.com" | makemv hostname delim="," | mvexpand hostname | search NOT hostname IN ("*.domain1.com", "*.domain2.com") </CODE></PRE> Wed, 31 Jul 2019 17:12:55 GMT https://community.splunk.com/t5/Splunk-Search/Does-IN-support-wildcards/m-p/419538#M120627 niketn 2019-07-31T17:12:55Z https://community.splunk.com/t5/Splunk-Search/Does-IN-support-wildcards/m-p/419539#M120628 <P>Thanks a lot.</P> Wed, 31 Jul 2019 19:04:43 GMT https://community.splunk.com/t5/Splunk-Search/Does-IN-support-wildcards/m-p/419539#M120628 danielbb 2019-07-31T19:04:43Z