https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Search/m-p/51137#M12308 <P>The best solution would be to use a subsearch for this purpose:</P> <PRE><CODE>* [ | metadata type=hosts | regex host="chvj[34]04ld8[246]" | fields host ] </CODE></PRE> <P>Alternatively you could search for all events and filter based on the regex:</P> <PRE><CODE>* | regex host="chvj[34]04ld8[246]" </CODE></PRE> Wed, 15 Sep 2010 23:24:32 GMT ziegfried 2010-09-15T23:24:32Z https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Search/m-p/51136#M12307 <P>Hello,</P> <P>i want all records from some hosts.</P> <P>How can i find records from hosts that match: host=chvj[34]04ld8[246] ?</P> <P>Cheers,</P> <P>Jens</P> Wed, 15 Sep 2010 23:19:09 GMT https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Search/m-p/51136#M12307 JensT 2010-09-15T23:19:09Z https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Search/m-p/51137#M12308 <P>The best solution would be to use a subsearch for this purpose:</P> <PRE><CODE>* [ | metadata type=hosts | regex host="chvj[34]04ld8[246]" | fields host ] </CODE></PRE> <P>Alternatively you could search for all events and filter based on the regex:</P> <PRE><CODE>* | regex host="chvj[34]04ld8[246]" </CODE></PRE> Wed, 15 Sep 2010 23:24:32 GMT https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Search/m-p/51137#M12308 ziegfried 2010-09-15T23:24:32Z https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Search/m-p/51138#M12309 <P>The second search is not suitable in our environment as we produce to much events.</P> <P>But the first search seems to be okay. (not nice, tough)</P> <P>Thanks,</P> <P>Jens</P> Thu, 16 Sep 2010 00:28:18 GMT https://community.splunk.com/t5/Splunk-Search/Regular-expression-in-Search/m-p/51138#M12309 JensT 2010-09-16T00:28:18Z