Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Wildcards in search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need some help on the syntax of wildcards in the search. I have multiple servers and I don't want to keep using OR. For example I have "server01" through "server21" and I sometimes want to just pull out results for server3 through server6.
In Linux I can specify server0[3-6]. What is the Splunk equivalent?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no equivalent in Splunk, sorry.
However, you can tag your servers. For example, if you tag a set of servers (server03 to server06) as "Singapore" then you could search
tag=Singapore
It's a great way to do a variety of shortcuts for searches. Also, tags can be shared so that everyone on your team can use them.
Here's a video on tags: http://www.splunk.com/view/SP-CAAAGYJ
The documentation is here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Lisa's answer is a good approach.
Another way to solve this in the search language is to use the regex command.
Note, the base search pulls all events BEFORE regex has a chance to filter results, so it is important to make the base search as specific as possible. An example using above requirements:
host=server0* | regex host="server0[3-6]"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good point. I use regex a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no equivalent in Splunk, sorry.
However, you can tag your servers. For example, if you tag a set of servers (server03 to server06) as "Singapore" then you could search
tag=Singapore
It's a great way to do a variety of shortcuts for searches. Also, tags can be shared so that everyone on your team can use them.
Here's a video on tags: http://www.splunk.com/view/SP-CAAAGYJ
The documentation is here
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
