Splunk Search
Highlighted

Why do wildcards in the middle of a string produce inconsistent results?

Ultra Champion

The studying material says that -

-- Wildcards in the middle of a string produce inconsistent results.

Why is it?

0 Karma
Highlighted

Re: Why do wildcards in the middle of a string produce inconsistent results?

SplunkTrust
SplunkTrust

From which documentation is this?

0 Karma
Highlighted

Re: Why do wildcards in the middle of a string produce inconsistent results?

Ultra Champion

From the *Splunk Fundamentals Part 2 (IOD) * course.

0 Karma
Highlighted

Re: Why do wildcards in the middle of a string produce inconsistent results?

Ultra Champion

I would say thats not correct at all.

String matching is very predictable, and I frequently match all kinds of things with *'s in the middle.

host=-uk--* matches LIVE-uk-web-02 perfectly.
Never had any problem with it.

Are you sure it didn't say "inefficient" - a query filled with wildcards is not as fast as something specifically defined

0 Karma
Highlighted

Re: Why do wildcards in the middle of a string produce inconsistent results?

Champion
0 Karma
Highlighted

Re: Why do wildcards in the middle of a string produce inconsistent results?

Ultra Champion

sounds like one for @martin_mueller to help with then 🙂

0 Karma
Highlighted

Re: Why do wildcards in the middle of a string produce inconsistent results?

Esteemed Legend
0 Karma