Page 1 of 1
NLS query with wildcard in it
Posted: Sat Oct 08, 2016 3:26 am
by WillemDH
Hello,
I would like to use * in part of a query, but this doesn't seem to work.
Code: Select all
Example query: type:"eventlog" AND hostname:"exch*.domain"
The above would then get me al the eventlogs of the exch hosts exchdc01.domain and exchac01.domain and exchac02.domain
Grtz
Willem
Re: NLS query with wildcard in it
Posted: Mon Oct 10, 2016 2:00 am
by Box293
Does it work if you don't use the quotes?
Code: Select all
type:eventlog AND hostname:exch*.domain
Re: NLS query with wildcard in it
Posted: Wed Oct 12, 2016 4:21 am
by WillemDH
Troy,
I'm not getting any results using your suggestion.
Code: Select all
type:eventlog AND hostname:exch*.domain.be
The only way i'm getting a result if I specify the full hostname. Are you sure wildcards are supported by nls?
Grtz
Re: NLS query with wildcard in it
Posted: Wed Oct 12, 2016 9:55 am
by mcapra
WillemDH wrote:Are you sure wildcards are supported by nls?
Yes, but perhaps not exactly in the way one might expect them to.
See if this logic produces the desired result:
Code: Select all
type:eventlog AND hostname:exch* AND hostname:*.domain
Otherwise, if you could provide some sample events with the hostname field highlighted I can play around with this.