Splunk Search

Is it possible to use wildcards to search by the last letter of a string?

vanessedt
New Member

I am looking for specific usernames in my data set that end in "a". What would the syntax be to search the username fields so that only usernames ending in "a" will appear? Is it even possible?

0 Karma
1 Solution

rjthibod
Champion

Assuming your username field is known as user, the search would be something like index=<...> sourcetype=<...> user=*a | ...

You will need to share more information about your data and the search If your fields aren't being extracted correctly and a variation of what I proposed doesn't work.

View solution in original post

0 Karma

rjthibod
Champion

Assuming your username field is known as user, the search would be something like index=<...> sourcetype=<...> user=*a | ...

You will need to share more information about your data and the search If your fields aren't being extracted correctly and a variation of what I proposed doesn't work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...