Splunk Filtering through regex

[machosplunker]

I am trying to filtering results based on hosts which are our hbase zookeepers and region servers. There are 3 hbase clusters overall

Cluster1

test101
test102
test103
..
test116

Cluster2

test117
test118
..
test125

Cluster3

test126
..
test138

is it possible to filter these three clusters by regex by something like this. This is what i currently have to filter the first cluster it doesn't seem to be working.

host="test"|regex_raw="\b0[1]1[0-1]2[0-9]\b"  

[martin_mueller · Accepted solution]

I see two alternatives to regex-based filtering: You could either tag your hosts with cluster1, cluster2, and cluster3, or you could have a numeric field from 101 to 138 and filter using arithmetic comparators, ie cluster1 would be hostnumber>=101 AND hostnumber<=116. In fact, you can use the comparison operators with string ordering, but I'm not certain how efficient this would be: host>="test101" AND host<="test116"

Tagging likely is the most efficient way, and the splunkiest.

[machosplunker]

that is so sweet!

[machosplunker]

i think ideal way might be filtering by specifying range like for cluster1 host="test"|"101-116", cluster2 host="test"|"117-125" not sure how to go about to get this.