Splunk Search

Use wildcard in source?

nishantjiit
New Member

I have a directory C:\logs

in this directory I have multiple files:

1: logging-projectname-0.log (There can be multiple files like *-1.log, *-2.log etc..)
2: logging-projectname-batch-0.log (There can be multiple files like *batch-1.log, *batch-2.log etc..)

I only want to search the files like #1. So, I tried ---- source="c:\logs\logging-projectname-[0-9]{1,}.log" SEARCH_STRING

It's not working. Can anyone suggest?

Thanks in advance.

0 Karma
1 Solution

somesoni2
Revered Legend

Another option would be this

your base search | regex source="c:\\\\logs\\\\logging-projectname-\d+\.log"

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

source uses wildcards, not regular expressions. somesoni2's suggestion should work.

---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

Another option would be this

your base search | regex source="c:\\\\logs\\\\logging-projectname-\d+\.log"

nishantjiit
New Member

Thanks it worked

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@nishantjiit, please accept an answer.

---
If this reply helps you, Karma would be appreciated.
0 Karma

skalliger
Motivator

Why don't you just use a wildcard like you mentioned it yourself?
Nevermind that.

Skalli

edit: deleted my search string.

0 Karma

xavierashe
Contributor

This should be an OR, not an AND.

0 Karma

skalliger
Motivator

Oh, you're correct. I've misread that. Thought he wants only one but not the other one.

I'll edit it.

0 Karma

horsefez
Motivator

@skalliger
stop being a noob 😛 😄

0 Karma

skalliger
Motivator

Should have deleted my comment. 😄

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...