- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Wildcards in search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
I need some help on the syntax of wildcards in the search. I have multiple servers and I don't want to keep using OR. For example I have "server01" through "server21" and I sometimes want to just pull out results for server3 through server6.
In Linux I can specify server0[3-6]. What is the Splunk equivalent?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
There is no equivalent in Splunk, sorry.
However, you can tag your servers. For example, if you tag a set of servers (server03 to server06) as "Singapore" then you could search
tag=Singapore
It's a great way to do a variety of shortcuts for searches. Also, tags can be shared so that everyone on your team can use them.
Here's a video on tags: http://www.splunk.com/view/SP-CAAAGYJ
The documentation is here
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Lisa's answer is a good approach.
Another way to solve this in the search language is to use the regex command.
Note, the base search pulls all events BEFORE regex has a chance to filter results, so it is important to make the base search as specific as possible. An example using above requirements:
host=server0* | regex host="server0[3-6]"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
Good point. I use regex a lot.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
There is no equivalent in Splunk, sorry.
However, you can tag your servers. For example, if you tag a set of servers (server03 to server06) as "Singapore" then you could search
tag=Singapore
It's a great way to do a variety of shortcuts for searches. Also, tags can be shared so that everyone on your team can use them.
Here's a video on tags: http://www.splunk.com/view/SP-CAAAGYJ
The documentation is here
How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.
Learn More or Register Now >
