![]() ![]() A search to match everything is both inefficient and time consuming. All events are retrieved, up to the maximum limit. If you specify an asterisk with no other criteria, you are asking to match everything. Where like(ipaddress, "198.%") search sourcetype="access_*" Be efficient When you use a wildcard character, the string must be enclosed in quotation marks. Wildcard strings must be in quotation marks Use to match an unlimited number of characters in a string. See the like (, ) function in the list of Comparison and Conditional eval functions. ![]() Use the underscore ( _ ) character to match a single character. Use the percent ( % ) symbol to match multiple characters. LIKE function with the percent ( % ) symbol or underscore ( _ ) character The following table describes the supported wildcards: The wildcard that you use depends on the command that you are using the wildcard with. With SPL2, you can use wildcards to match characters in string values. ![]()
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |