Splunk search for range of characters

[dvohra]

Hi All.. how can I search a range of characters in splunk.. example I want to search name of people whose name starts with A-L but not M-Z

user = [A*-Z*] , can I have something like this ?

[ITWhisperer]

| regex user="^[A-L]"

[bowesmana]

You can't use regex in a search command but could do this

search ...
| where match(user, "^[A-L]")

which will filter only users starting with A-L

 or this

search...
    [| makeresults 
    | fields - _time
    | eval user=split("ABCDEFGHIJKL","") 
    | mvexpand user 
    | eval user=user."*" ] 

which uses a subsearch which effectively turns the search into

search ((user=A* OR user=B* OR user=C*...))