container_name="foo-foo2-sd4ofk4pokf4dspo54455c23c2b0d354" This should work. If it is not, I would look at the _raw event and make sure the hyphens aren't encoded or something. As mentioned earlier, you can't wildcard breaking characters, so the asterisk solution isn't expected to work. You can use the decimal wildcard in regex for the hyphen though.  search | regex container_name="foo.foo2.sd4ofk4pokf4dspo54455c23c2b0d354"   ... View more