How to create a wildcard search of a field which is a jobname and getall values starting with A through M anycase?

[mihir_hardas]

I need a list of only those jobName which start with letter a though m - anycase.

The below does not work

index=log-13120-nonprod-c laas_appId=qbmp.prediction-engine sourcetype="qbmp.prediction-engine:app" "predicted as Prediction" | table jobName | dedup jobName | where jobName like "[a-m]%"

sample event is like this below

08-06-2022 10:19:36.990 [task-53] INFO c.m.b.p.service.PredictionWorkerV2#run - predictionId=1e5a96c6-5f90-4bf9-b0df-7f3528ae642b, threadId=23, job=SRW-REPAPER-LoadedStatus^QNA predicted as Prediction{predictionId='1e5a96c6-5f90-4bf9-b0df-7f3528ae642b', jobName='SRW-REPAPER-LoadedStatus', instance='QNA', predictionStatus='cant_predict', predictedStartTime=-1, predictedFinishTime=-1, predictionExplanation='no_jobstats', predictedAt=1654697976}

The above event has jobName='SRW-REPAPER-LoadedStatus' and it does not start with a letter from a through m. So it should not be displayed.

[gcusello · Accepted solution]

Hi @mihir_hardas,

you should try to use the regex command (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Regex) to filter your results, something like this:

index=log-13120-nonprod-c laas_appId=qbmp.prediction-engine sourcetype="qbmp.prediction-engine:app" "predicted as Prediction" 
| dedup jobName 
| regex jobName="^[a-mA-M].*"
| table jobName 

Ciao.

Giuseppe

[gcusello]

Hi @mihir_hardas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉