- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Why do wildcards in the middle of a string pro...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The studying material says that -
-- Wildcards in the middle of a string produce inconsistent results.
Why is it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check out the Splunk .conf talk by Martin Mueller:
https://conf.splunk.com/files/2017/slides/fields-indexed-tokens-and-you.pdf
Page 18 of 32.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is Splunk's official word:
https://docs.splunk.com/Documentation/Splunk/latest/Search/Wildcards#Avoid_using_wildcards_in_the_mi...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check out the Splunk .conf talk by Martin Mueller:
https://conf.splunk.com/files/2017/slides/fields-indexed-tokens-and-you.pdf
Page 18 of 32.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sounds like one for @martin_mueller to help with then 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would say thats not correct at all.
String matching is very predictable, and I frequently match all kinds of things with *'s in the middle.
host=-uk--* matches LIVE-uk-web-02 perfectly.
Never had any problem with it.
Are you sure it didn't say "inefficient" - a query filled with wildcards is not as fast as something specifically defined
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From which documentation is this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
From the *Splunk Fundamentals Part 2 (IOD) * course.
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
