Wildcard in the middle of hostname

[Chakri]

Below is my search

| inputlookup uf_ssl_kv_lookup
| search hostname=AB100*TILL* hostname!=AB100*TILL100 hostname!=AB100*TILL101 hostname!=AB100*TILL102 hostname!=AB100*TILL150 hostname!=AB100*TILL151

When I ran the above search I see below warning, how to avoid the warning. 

The term 'hostname!=AB100*TILL100' contains a wildcard in the middle of a word or string. This might cause inconsistent results if the characters that the wildcard represents include punctuation

There are 100's of stores and 1000's of tills. How to modify my search?

Note: I can't change the lookup table.

Example hostname=AB1001234TILL1

in hostname WE -- stands for type

100 -- Country Code

1234 - store number

TILL1 -- Till number

[yuanliu]

I do not recommend where command as a general substitute for search command, but @ITWhisperer is correct in that regex is more appropriate for your use case, especially because your data comes from inputlookup.

| inputlookup uf_ssl_kv_lookup
| where match(hostname, "^AB100\d+TILL") AND NOT match(hostname, "TILL(100|101|102|150|151)$")

[ITWhisperer]

You can use regex to filter events

| regex hostname="AB(100|110|130)\d{4}TILL\d+$(?<!(100|101|102|150|151))"

[livehybrid]

Hi @Chakri 

Does the following work for you? I havent got Splunk infront of me at the moment to test but I will generate some test data to check shortly.

| search hostname=AB100* hostname=*TILL* hostname!=*TILL100 hostname!=*TILL101 hostname!=*TILL102 hostname!=*TILL150 hostname!=*TILL151

This allows hostname=AB100* and then removes those ending with 100,101,102,150,151

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will

[Chakri]

Hi @livehybrid 

I forgot to mention one more detail, we have 3 country codes like 100, 110,130.

and the hostnames will be like this,

AB1001234TILL1

AB1101234TILL1

AB1301234TILL1

So I have to differentiate, it based on store, country and Till.

[livehybrid]

Hi @Chakri 

I think the example I gave you should be able to specify any particular country code / store number in the first bit (hostname=AB123*) 

The second part then removes the TILLS from that store which you are not interested in.

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will