regex operator in Splunk is not working to match results

[vatsalyay]

I am writing a code to simply match a regex in my search to match index field which matches app1_, app2_, etc

However my search below works

| eventcount summarize=false index=app1_*| dedup index
But when I use it like below it doesn't, it would be required to be done using regex since I would like to use an "OR" in the regex:

| eventcount summarize=false |regex index="app1_*"| dedup index

[VatsalJagani]

Hello @vatsalyay,

I'm afraid app1_* will search for app1_, app1__, app_____, etc. Search command use * as wildcard but regex is different. To do the same in regex you might require to use app1_.* , where . means any characters and * means any number of occurrence.
Test your regex more here - https://regex101.com/

Hope this helps!!!

[richgalloway]

The regex command requires uses regular expressions to match the specified field value. It's not the same as the pattern used for matching in the eventcount command. What you have in your example is a valid regular expression, but calls for the letters "app1" followed by zero or more underscores. You probably want "app1_.", which is the regex equivalent to the pattern "app1_*" in the first code sample.