Using wildcards efficiently
Though the index is based on words, it is possible to use wildcards when needed, albeit a little carefully. Take a look at some interesting facts about wildcards:
- Only trailing wildcards are efficient: Stated simply,
bob*
will find events containing Bobby efficiently, but*by
or*ob*
will not. The latter cases will scan all events in the time frame specified. - Wildcards are tested last: Wildcards are tested after all other terms. Given the search:
authclass *ob* hello world
, all other terms besides*ob*
will be searched first. The more you can limit the results using full words and fields, the better your search will perform.
Supplementing wildcards in fields
Given the following events, a search for world would return both ...
Get Implementing Splunk - Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.