How do i use wildcard characters in my Splunk search?
For example : i am looking for only 4xx http errors .
index=my_index host=host123 "dummy-web.com" http_status_code=4XX
in regex i can use 4.. or 4.* ..but how do i use in Splunk?
Like this:
index="my_index" host="host123" "dummy-web.com" http_status_code="4*"
Try this
index=my_index host=host123 "dummy-web.com" http_status_code=4*