https://community.splunk.com/t5/Splunk-Search/Wildcards-in-search/m-p/68173#M17058 <P>Lisa's answer is a good approach. </P> <P>Another way to solve this in the search language is to use the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex">regex</A> command.<BR /><BR /> Note, the base search pulls all events BEFORE regex has a chance to filter results, so it is important to make the base search as specific as possible. An example using above requirements:</P> <PRE><CODE>host=server0* | regex host="server0[3-6]" </CODE></PRE> Thu, 19 Sep 2013 16:49:39 GMT bwooden 2013-09-19T16:49:39Z https://community.splunk.com/t5/Splunk-Search/Wildcards-in-search/m-p/68171#M17056 <P>I need some help on the syntax of wildcards in the search. I have multiple servers and I don't want to keep using OR. For example I have "server01" through "server21" and I sometimes want to just pull out results for server3 through server6.</P> <P>In Linux I can specify server0[3-6]. What is the Splunk equivalent?</P> Thu, 19 Sep 2013 16:09:10 GMT https://community.splunk.com/t5/Splunk-Search/Wildcards-in-search/m-p/68171#M17056 mdavis43 2013-09-19T16:09:10Z https://community.splunk.com/t5/Splunk-Search/Wildcards-in-search/m-p/68172#M17057 <P>There is no equivalent in Splunk, sorry.</P> <P>However, you can <EM>tag</EM> your servers. For example, if you tag a set of servers (server03 to server06) as "Singapore" then you could search</P> <PRE><CODE>tag=Singapore </CODE></PRE> <P>It's a great way to do a variety of shortcuts for searches. Also, tags can be shared so that everyone on your team can use them.</P> <P>Here's a video on tags: <A href="http://www.splunk.com/view/SP-CAAAGYJ">http://www.splunk.com/view/SP-CAAAGYJ</A><BR /><BR /> The documentation is <A href="http://docs.splunk.com/Documentation/Splunk/5.0.4/Knowledge/Abouttagsandaliases">here</A></P> Thu, 19 Sep 2013 16:38:27 GMT https://community.splunk.com/t5/Splunk-Search/Wildcards-in-search/m-p/68172#M17057 lguinn2 2013-09-19T16:38:27Z https://community.splunk.com/t5/Splunk-Search/Wildcards-in-search/m-p/68173#M17058 <P>Lisa's answer is a good approach. </P> <P>Another way to solve this in the search language is to use the <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Regex">regex</A> command.<BR /><BR /> Note, the base search pulls all events BEFORE regex has a chance to filter results, so it is important to make the base search as specific as possible. An example using above requirements:</P> <PRE><CODE>host=server0* | regex host="server0[3-6]" </CODE></PRE> Thu, 19 Sep 2013 16:49:39 GMT https://community.splunk.com/t5/Splunk-Search/Wildcards-in-search/m-p/68173#M17058 bwooden 2013-09-19T16:49:39Z https://community.splunk.com/t5/Splunk-Search/Wildcards-in-search/m-p/68174#M17059 <P>Good point. I use <CODE>regex</CODE> a lot.</P> Thu, 19 Sep 2013 17:00:02 GMT https://community.splunk.com/t5/Splunk-Search/Wildcards-in-search/m-p/68174#M17059 lguinn2 2013-09-19T17:00:02Z