Splunk wildcard for specific position of character in a host list

[utk123]

I have a table with more than 50000 hostnames. I want to run a wild card for 5th & 6th character in a hostname list.

My list sample:

hostname

SERVINBBB01

SERRCNAAA01

SERSSPBBC55

SERRINAAC98

SERWINSSS11

In my search result, I want to get list of hosts with IN in 5th & 6th location.

Results should be:

hostname

SERVINBBB01

SERRINAAC98

SERWINSSS11

With asterisk(*) (example: *IN*) I am not able to get these results, as characters before and after 5th, 6th position are not same always.

[utk123]

Thanks KV, that works perfect.

[kamlesh_vaghela · Accepted solution]

@utk123 

Can you please try this?

YOUR_SEARCH 
| regex hostname="(?<=^.{4})IN"

My Sample Search :

| makeresults | eval _raw="hostname
SERVINBBB01
SERRCNAAA01
SERSSPBBC55
SERRINAAC98
SERWINSSS11
"| multikv forceheader=1
| table hostname | regex hostname="(?<=^.{4})IN"

 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.