How to use punctuation in a search string: (), [], and *?

[lzamora33]

Hi there,

Really basic question but I can't find a detailed answer.
Can someone explain the different uses of (), [], and example in the search app?

Thanks in advance.

[rkyadav]

example : (warn OR error) NOT fail*

Retrieves all events containing either
“warn” or “error”, but not those that
have “fail”, “fails”, “failed”, failure”,
etc.

example 2 : sourcetype=syslog [search login error | return user]

here, search command, like all commands, can be used as a subsearch—a
search whose results are used as an argument to another search command.
Subsearches are enclosed in square brackets. For example, to find
all syslog events from the user that had the last login error, use the following
command: sourcetype=syslog [search login error | return user]

hope it gives some help to your query

[lzamora33]

last question, what happen whit a search between asterisks example source_type = asterisksexampleasterisks

[rkyadav]

when you search for sourcetype=example , it will fetch all sourcetype which has example as suffix or prefix .

like sourcetypes one_example or example_two will be displayed

[lzamora33]

Thanks buddy, that's what i was looking for.

[sensitive-thug]

Thank you for asking a question, I'm glad you found a helpful answer from @rkyadav. If their answer solved your issue please accept their answer.