Splunk Search

How to add a wild card to all the field values at the end of a field?

pavanae
Builder

I have a query as follows

| inputlookup hosts.csv | table host | format

Which gives the result as follows

( ( host="abc" ) OR ( host="def" ) OR ( host="ghi" ) OR ( host="jkl" ))

Now, how to modify my current query to get the result as follows

( ( host="abc*" ) OR ( host="def*" ) OR ( host="ghi*" ) OR ( host="jkl*" ))

Is there any way that I can add the wildcard to all the host field values either by eval or regex. Please let me know if there is any possibility?

1 Solution

elliotproebstel
Champion

Very easy! Just do this:

| inputlookup hosts.csv 
| table host 
| eval host=host."*"
| format

That will append a wildcard to the end of the string in each host field.

View solution in original post

elliotproebstel
Champion

Very easy! Just do this:

| inputlookup hosts.csv 
| table host 
| eval host=host."*"
| format

That will append a wildcard to the end of the string in each host field.

pavanae
Builder

worked perfect. Thank you @elliotproebstel

0 Karma

clintla
Contributor

So if you use
| eval name1=upper(name1)."*"
| search host=name1

This should work right?

When I look at the field values- Name is exactly correct but when I use the name1 field it doesnt work.
if I swap it out with just the value- it works.. almost like the wildcard doesnt count if its in the field.

0 Karma

elliotproebstel
Champion

Glad to help 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...