Will using a wildcard with where work?

[brcox9090]

I am trying to get a wildcard to work with a where clause. Not sure if I'm doing something wrong altogether or just missing some syntax but my search is as follows:

index=my_index | where description=" Changed * role to * Admin"

basically looking up whether any user had their role changed to any admin role. Thought this would be an easy one, and it is not.

[richgalloway]

The where command does not support wildcards.  As @gcusello says, use the search command or, best, put the text in the base search.

To use wildcards in where, we need to use either the match or like function.

| where match(_raw, " Changed .* role to .* Admin")

| where like(_raw, " Changed % role to % Admin")

[gcusello]

Hi @brcox9090,

why do you want to use where?

is there something between the main search and the where command?

if yes, Anyway, use the search command, instead where.

otherwise, you can put all in the main search so you'll have a more performant search.

index=my_index description=" Changed * role to * Admin"

Ciao.

Giuseppe