Splunk Search

Regular expression in Search

JensT
Communicator

Hello,

i want all records from some hosts.

How can i find records from hosts that match: host=chvj[34]04ld8[246] ?

Cheers,

Jens

Tags (1)

ziegfried
Influencer

The best solution would be to use a subsearch for this purpose:

* [ | metadata type=hosts | regex host="chvj[34]04ld8[246]" | fields host ]

Alternatively you could search for all events and filter based on the regex:

* | regex host="chvj[34]04ld8[246]"

JensT
Communicator

The second search is not suitable in our environment as we produce to much events.

But the first search seems to be okay. (not nice, tough)

Thanks,

Jens

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...