Splunk Search

How to use wildcard characters in Splunk search?

How do i use wildcard characters in my Splunk search?

For example : i am looking for only 4xx http errors .

index=my_index host=host123  "dummy-web.com" http_status_code=4XX 

in regex i can use 4.. or 4.* ..but how do i use in Splunk?

0 Karma

Esteemed Legend

Like this:

 index="my_index" host="host123" "dummy-web.com" http_status_code="4*"
0 Karma

SplunkTrust
SplunkTrust

Try this

index=my_index host=host123 "dummy-web.com" http_status_code=4*