topic Re: How to use a wildcard in a where clause? in Splunk Search

How to use a wildcard in a where clause?

rndp89 — Tue, 26 Apr 2016 06:00:31 GMT

I am using the search below to shunt "ORA-00001" from a set of log files. This search works fine for just one log file.

index=xyz* NOT [search index=xyz* "*ORA-00001*" | WHERE source="/logs/sit/camel-audit.log"]

but when I put a wildcard in the where clause, it doesn't work. Could you please help me on how to use wildcard in a where clause?

index=xyz* NOT [search index=xyz* "*ORA-00001*" | WHERE source="/logs/*/camel-audit.log"]

ctaf — Tue, 26 Apr 2016 12:54:13 GMT

Hello,

Why using a where clause?
You could just do:
index=xyz* NOT [search index=xyz* "ORA-00001" source="/logs/*/camel-audit.log"]

And perhaps even simpler:
index=xyz* NOT ("ORA-00001" AND source="/logs/*/camel-audit.log")

richgalloway — Tue, 26 Apr 2016 13:09:28 GMT

@ctaf's comment is a good one, but if you insist on using the where command you can't use wildcards. Try like, instead.

index=xyz* NOT [search index=xyz* "ORA-00001" | WHERE like(source,"/logs/%/camel-audit.log")]

Notice the like command uses SQL-style wildcards.

rndp89 — Thu, 28 Apr 2016 10:35:07 GMT

thank you .

rndp89 — Thu, 28 Apr 2016 10:36:51 GMT

thanks! it worked.

richgalloway — Thu, 28 Apr 2016 11:40:42 GMT

Please accept the answer.