Splunk Search

Using wildcards in a search string

andybeh
New Member

Hi All,

Can someone please explain how I use a wildcard character in the middle of a search string? For example, if I want find all gmail addresses that start with the letter 'a', I thought I could search for emailaddress="a*@gmail.com, however this returns all records. I guess I have to use a regex but my knowledge hasn't reached that level yet so I am struggling with this one.

Cheers

AB

Tags (1)
0 Karma

gopala
New Member

Is not working for me either.

I tried
index=my_index | regex my_field="^my*.value.com"

and it is not finding anything even I

Where it should match
my1.value.com
my2.value.com
my100.value.com
etc....

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

other than the fact that you are missing a closing double quote in your example. That will work fine.
Is that a typo?

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!

laithmurad
Path Finder

Hi AB,

Strange, I just tried you're search query emailaddress="a*@gmail.com" and it worked to filter emails that starts with an a, wildcards should work like you expected.

Alternatively use the regex command to filter you're results, for you're case just append this command to you're search.

| regex emailaddress="^a.*@gmail.com"

This will find all emails that starts with an "a" and ends with "@gmail.com"

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...