Implementing Splunk 7(Third Edition)
上QQ阅读APP看书,第一时间看更新

Using wildcards efficiently

Though the index is based on words, it is possible to use wildcards when necessary, albeit a little carefully. Take a look at some interesting facts about wildcards:

  • Only trailing wildcards are efficient: Stated simply, bob* will find events containing Bobby efficiently, but *by or *ob* will not. The latter cases will scan all events in the time frame specified.
  • Wildcards are tested last: Wildcards are tested after all other terms. Given the search authclass *ob* hello world, all other terms besides *ob* will be searched first. The more you can limit the results using full words and fields, the better your search will perform.