topic how to make a search for two or more source file with wildcard or regex? in Splunk Search

how to make a search for two or more source file with wildcard or regex?

iamuser — Thu, 17 Jun 2021 18:43:54 GMT

What search criteria should I include to only get these logs?

D:\Applications\Windows.App.0001\app1\logs\log-06-17-2021-Test.log
D:\Applications\Windows.App.0002\app1\logs\log-06-17-2021-Test.log
D:\Applications\Windows.App.0003\app1\logs\log-06-172021-Test.log
D:\Applications\PBS20.01\app1\logs\log-06-17-2021-Test.log
D:\Applications\PBS20.02\app1\logs\log-06-17-2021-Test.log
D:\Applications\PBS20.03\app1\logs\log-06-17-2021-Test.log
D:\Applications\DDS0\app1\logs\log-06-17-2021-Test.log
D:\Applications\DDS1\app1\logs\log-06-17-2021-Test.log

I tried this but it did not work

source="*Windows.App*log*Test.log" source="*PBS20*log*Test.log" source="*DDS*log*Test.log"
or this:
source="*Windows.App*log*Test.log" or source="*PBS20*log*Test.log" or source="*DDS*log*Test.log"
or this:
source="*(Windows.App|PBS20|DDS)*log*Test.log)"

I can not use the "Applications " keyword since this is a common folder a crosses all applications we are using.

Thanks

Re: how to make a search for two or more source file with wildcard or regex?

richgalloway — Thu, 17 Jun 2021 18:32:26 GMT

The first form won't work because of the implied AND operator between each expression. The source field cannot have more than one value at a time.

The second form should work, but the OR operator must be in upper-case.

The third form may work, but not as expected. The search command does not support regular expressions so it will try to find the specified string literally.

Re: how to make a search for two or more source file with wildcard or regex?

iamuser — Thu, 17 Jun 2021 18:43:07 GMT

Thanks. The upper OR works. The other option I used is by using subquery. similar to this:
source="D:\\Applications*Test.Log" |
where like(source,"%Windows.App%log%Test.log") or like(source,"%PBS20%log%Test.log") or like(source,"%DDS%log%Test.log") |
table source, _raw