Splunk Search

How to create a wildcard search of a field which is a jobname and getall values starting with A through M anycase?

mihir_hardas
Explorer

 

I need a list of only those jobName which start with letter a though m - anycase.

The below does not work

index=log-13120-nonprod-c laas_appId=qbmp.prediction-engine sourcetype="qbmp.prediction-engine:app" "predicted as Prediction" | table jobName | dedup jobName | where jobName like "[a-m]%"

 

 

sample event is like this below

 

 

08-06-2022 10:19:36.990 [task-53] INFO c.m.b.p.service.PredictionWorkerV2#run - predictionId=1e5a96c6-5f90-4bf9-b0df-7f3528ae642b, threadId=23, job=SRW-REPAPER-LoadedStatus^QNA predicted as Prediction{predictionId='1e5a96c6-5f90-4bf9-b0df-7f3528ae642b', jobName='SRW-REPAPER-LoadedStatus', instance='QNA', predictionStatus='cant_predict', predictedStartTime=-1, predictedFinishTime=-1, predictionExplanation='no_jobstats', predictedAt=1654697976}

 

 

The above event has jobName='SRW-REPAPER-LoadedStatus' and it does not start with a letter from a through m. So it should not be displayed.

Labels (3)
Tags (1)
0 Karma
1 Solution

gcusello
Esteemed Legend

Hi @mihir_hardas,

you should try to use the regex command (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Regex) to filter your results, something like this:

index=log-13120-nonprod-c laas_appId=qbmp.prediction-engine sourcetype="qbmp.prediction-engine:app" "predicted as Prediction" 
| dedup jobName 
| regex jobName="^[a-mA-M].*"
| table jobName 

Ciao.

Giuseppe

 

View solution in original post

gcusello
Esteemed Legend

Hi @mihir_hardas,

you should try to use the regex command (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Regex) to filter your results, something like this:

index=log-13120-nonprod-c laas_appId=qbmp.prediction-engine sourcetype="qbmp.prediction-engine:app" "predicted as Prediction" 
| dedup jobName 
| regex jobName="^[a-mA-M].*"
| table jobName 

Ciao.

Giuseppe

 

gcusello
Esteemed Legend

Hi @mihir_hardas,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...