Splunk Search

Does IN support wildcards?

Motivator

The following doesn't seem to work -

NOT hostname IN ("*.<domain1>.com", "*.<domain2>.com")

Does IN support wildcards?

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

@danielbb yes it should so if it is not working then please add more details as to what you are trying to do and what is your current data/SPL (mock/anonymize any sensitive information before posting on Splunk Answers).

Meanwhile based on the code/data snippet provided in the question, try the following run anywhere example search:

| makeresults 
| fields - _time 
| eval hostname="test1.domain1.com,test2.domain1.com,test3.domain2.com,test4.domain3.com" 
| makemv hostname delim="," 
| mvexpand hostname 
| search NOT hostname IN ("*.domain1.com", "*.domain2.com")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@danielbb yes it should so if it is not working then please add more details as to what you are trying to do and what is your current data/SPL (mock/anonymize any sensitive information before posting on Splunk Answers).

Meanwhile based on the code/data snippet provided in the question, try the following run anywhere example search:

| makeresults 
| fields - _time 
| eval hostname="test1.domain1.com,test2.domain1.com,test3.domain2.com,test4.domain3.com" 
| makemv hostname delim="," 
| mvexpand hostname 
| search NOT hostname IN ("*.domain1.com", "*.domain2.com")
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Motivator

Thanks a lot.

0 Karma