Constructing a search term with ( AND ) statement (WITHIN) nth Characters

[J_Walker_Ex]

Hello ,

I am constructing search

At the moment I am looking for ( X AND Y AND Z)

This is working well but I am returning lots of results . see the made up examples below
XsoccerYfootballZ
XmancesterunitedYmanchestercityZ
timeZsleepingYthetimestherertertertertertredgfdX

what I would like to be able to do is restrict my results based on how many characters they are between one another

Ideally I would like X AND Y AND Z to be no more than three characters between. The dots represent the characters.
X...Z...Y

Also if possible I like it to be upto three characters

So it could be

X.Z...Y or X..Z...Y or X...Z..T and so on

So if its possible can I restrict the order that results have to be returned

So X has to become Z and Z has to be come before Y .

Is it possible to construct this sorts of searches terms ?

[woodcock]

You cannot do this (or I should say, should not do this) with a base search so keep your base search but then you can user regex like this:

... | regex _raw="(?:X.{0,3}Z{0,3}Y)|(?:X.{0,3}Z{0,5}T)"

[J_Walker_Ex]

Hello thanks for getting back to my question . Where about would I introduce the regex into the search. I m relatively new to doing to splunk. Would this be a secondary process

[woodcock]

It should be the first pipe in the list (just after your base search). You need to throw away the garbage as soon as possible in Splunk.

[cpetterborg]

Perhaps something like:

... | rex "(?P<match>X{0,3}Z{0,3}Y)"