how to (still) use a wildcard in the middle of a string?Splunk returns some queries much faster than othersSplunk - chart 2 time periods on 1 reportHow do I pass event arguments to python scripts that run in response to Splunk alerts?Splunk map without losing fieldsJenkins jobs console output going to / monitored by Splunk - How to fetch that data using CURL / Rest API for last N minutes / hours / days etcSplunk Tomcat Data ReportCompare two columns and return value from thirdPlotting large json as a table in splunkHow to extract data from the String in splunk?How to configure PagerDuty alerts in Splunk Cloud?
Make lens aperture in Tikz
Why is the Vasa Museum in Stockholm so Popular?
What is a Written Word™?
Is space radiation a risk for space film photography, and how is this prevented?
Is a switch from R to Python worth it?
What license to choose for my PhD thesis?
How does Geralt transport his swords?
…down the primrose path
what can you do with Format View
Broken bottom bracket?
split inside flalign
Did Logical Positivism fail because it simply denied human emotion?
Pronouns when writing from the point of view of a robot
How can I perform a deterministic physics simulation?
Probably terminated or laid off soon; confront or not?
A verb for when some rights are not violated?
Formal mathematical definition of renormalization group flow
Why is Heisenberg shown dead in Negro y Azul?
Song at end of Warehouse 13 season 4
Went to a big 4 but got fired for underperformance in a year recently - Now every one thinks I'm pro - How to balance expectations?
When using the Proficiency Dice optional rule, how should they be used in determining a character's Spell Save DC?
Does the problem of P vs NP come under the category of Operational Research?
Does a humanoid possessed by a ghost register as undead to a paladin's Divine Sense?
Piece de Resistance - Introduction & Ace and A's
how to (still) use a wildcard in the middle of a string?
Splunk returns some queries much faster than othersSplunk - chart 2 time periods on 1 reportHow do I pass event arguments to python scripts that run in response to Splunk alerts?Splunk map without losing fieldsJenkins jobs console output going to / monitored by Splunk - How to fetch that data using CURL / Rest API for last N minutes / hours / days etcSplunk Tomcat Data ReportCompare two columns and return value from thirdPlotting large json as a table in splunkHow to extract data from the String in splunk?How to configure PagerDuty alerts in Splunk Cloud?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I am trying to run the following query
index=one /thispath/file*.pdf
I know that using wildcards in the middle of a string is not recommended, but I have too many different files: file001.pdf, fileabc.pdf and others.
What can I do? I am more worried about bogus results than processing speed.
Thanks!
splunk
asked Mar 27 at 1:59
ℕʘʘḆḽḘℕʘʘḆḽḘ
7,72412 gold badges54 silver badges125 bronze badges
add a comment |
I am trying to run the following query
index=one /thispath/file*.pdf
I know that using wildcards in the middle of a string is not recommended, but I have too many different files: file001.pdf, fileabc.pdf and others.
What can I do? I am more worried about bogus results than processing speed.
Thanks!
splunk
asked Mar 27 at 1:59
ℕʘʘḆḽḘℕʘʘḆḽḘ
7,72412 gold badges54 silver badges125 bronze badges
add a comment |
I am trying to run the following query
index=one /thispath/file*.pdf
I know that using wildcards in the middle of a string is not recommended, but I have too many different files: file001.pdf, fileabc.pdf and others.
What can I do? I am more worried about bogus results than processing speed.
Thanks!
splunk
asked Mar 27 at 1:59
ℕʘʘḆḽḘℕʘʘḆḽḘ
7,72412 gold badges54 silver badges125 bronze badges
I am trying to run the following query
index=one /thispath/file*.pdf
I know that using wildcards in the middle of a string is not recommended, but I have too many different files: file001.pdf, fileabc.pdf and others.
What can I do? I am more worried about bogus results than processing speed.
Thanks!
splunk
splunk
asked Mar 27 at 1:59
ℕʘʘḆḽḘℕʘʘḆḽḘ
7,72412 gold badges54 silver badges125 bronze badges
asked Mar 27 at 1:59
ℕʘʘḆḽḘℕʘʘḆḽḘ
7,72412 gold badges54 silver badges125 bronze badges
asked Mar 27 at 1:59
ℕʘʘḆḽḘℕʘʘḆḽḘ
7,72412 gold badges54 silver badges125 bronze badges
asked Mar 27 at 1:59
ℕʘʘḆḽḘℕʘʘḆḽḘ
7,72412 gold badges54 silver badges125 bronze badges
asked Mar 27 at 1:59
ℕʘʘḆḽḘℕʘʘḆḽḘ
7,72412 gold badges54 silver badges125 bronze badges
7,72412 gold badges54 silver badges125 bronze badges
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
It's not recommended, but it works. Just do it.
index=one "/thispath/file*.pdf"
answered Mar 27 at 3:18
RichGRichG
1,1711 gold badge8 silver badges11 bronze badges
thanks but why do they say unexpected results then?
– ℕʘʘḆḽḘ
Mar 27 at 10:26
Where are you reading about unexpected results? I think it depends on context, but I don't recall ever having a problem with embedded wildcards (although I try to avoid them).
– RichG
Mar 27 at 15:08
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55368685%2fhow-to-still-use-a-wildcard-in-the-middle-of-a-string%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
It's not recommended, but it works. Just do it.
index=one "/thispath/file*.pdf"
answered Mar 27 at 3:18
RichGRichG
1,1711 gold badge8 silver badges11 bronze badges
thanks but why do they say unexpected results then?
– ℕʘʘḆḽḘ
Mar 27 at 10:26
Where are you reading about unexpected results? I think it depends on context, but I don't recall ever having a problem with embedded wildcards (although I try to avoid them).
– RichG
Mar 27 at 15:08
add a comment |
It's not recommended, but it works. Just do it.
index=one "/thispath/file*.pdf"
answered Mar 27 at 3:18
RichGRichG
1,1711 gold badge8 silver badges11 bronze badges
thanks but why do they say unexpected results then?
– ℕʘʘḆḽḘ
Mar 27 at 10:26
Where are you reading about unexpected results? I think it depends on context, but I don't recall ever having a problem with embedded wildcards (although I try to avoid them).
– RichG
Mar 27 at 15:08
add a comment |
It's not recommended, but it works. Just do it.
index=one "/thispath/file*.pdf"
answered Mar 27 at 3:18
RichGRichG
1,1711 gold badge8 silver badges11 bronze badges
It's not recommended, but it works. Just do it.
index=one "/thispath/file*.pdf"
answered Mar 27 at 3:18
RichGRichG
1,1711 gold badge8 silver badges11 bronze badges
answered Mar 27 at 3:18
RichGRichG
1,1711 gold badge8 silver badges11 bronze badges
answered Mar 27 at 3:18
RichGRichG
1,1711 gold badge8 silver badges11 bronze badges
answered Mar 27 at 3:18
RichGRichG
1,1711 gold badge8 silver badges11 bronze badges
1,1711 gold badge8 silver badges11 bronze badges
thanks but why do they say unexpected results then?
– ℕʘʘḆḽḘ
Mar 27 at 10:26
Where are you reading about unexpected results? I think it depends on context, but I don't recall ever having a problem with embedded wildcards (although I try to avoid them).
– RichG
Mar 27 at 15:08
add a comment |
thanks but why do they say unexpected results then?
– ℕʘʘḆḽḘ
Mar 27 at 10:26
Where are you reading about unexpected results? I think it depends on context, but I don't recall ever having a problem with embedded wildcards (although I try to avoid them).
– RichG
Mar 27 at 15:08
thanks but why do they say unexpected results then?
– ℕʘʘḆḽḘ
Mar 27 at 10:26
thanks but why do they say unexpected results then?
– ℕʘʘḆḽḘ
Mar 27 at 10:26
Where are you reading about unexpected results? I think it depends on context, but I don't recall ever having a problem with embedded wildcards (although I try to avoid them).
– RichG
Mar 27 at 15:08
Where are you reading about unexpected results? I think it depends on context, but I don't recall ever having a problem with embedded wildcards (although I try to avoid them).
– RichG
Mar 27 at 15:08
add a comment |
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Got a question that you can’t ask on public Stack Overflow? Learn more about sharing private information with Stack Overflow for Teams.
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55368685%2fhow-to-still-use-a-wildcard-in-the-middle-of-a-string%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
