Splunk Search

How to use wildcard characters in Splunk search?

chetanhonnavile
Explorer

How do i use wildcard characters in my Splunk search?

For example : i am looking for only 4xx http errors .

index=my_index host=host123  "dummy-web.com" http_status_code=4XX 

in regex i can use 4.. or 4.* ..but how do i use in Splunk?

0 Karma

woodcock
Esteemed Legend

Like this:

 index="my_index" host="host123" "dummy-web.com" http_status_code="4*"
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

index=my_index host=host123 "dummy-web.com" http_status_code=4*

Get Updates on the Splunk Community!

Fall Into Learning with New Splunk Education Courses

Every month, Splunk Education releases new courses to help you branch out, strengthen your data science roots, ...

Super Optimize your Splunk Stats Searches: Unlocking the Power of tstats, TERM, and ...

By Martin Hettervik, Senior Consultant and Team Leader at Accelerate at Iver, Splunk MVPThe stats command is ...

How Splunk Observability Cloud Prevented a Major Payment Crisis in Minutes

Your bank's payment processing system is humming along during a busy afternoon, handling millions in hourly ...