How do i use wildcard characters in my Splunk search?
For example : i am looking for only 4xx http errors .
index=my_index host=host123 "dummy-web.com" http_status_code=4XX
in regex i can use 4..
or 4.*
..but how do i use in Splunk?
Like this:
index="my_index" host="host123" "dummy-web.com" http_status_code="4*"
Try this
index=my_index host=host123 "dummy-web.com" http_status_code=4*