Wildcards

You can use the standard wildcard characters (* and ?) in queries to match variable characters or strings in log records. You can use more than the wildcard character.

Wildcard syntax

• The ? (question mark) matches one character.
• The * (asterisk) matches a character string.

Examples:

• Jo? shows Joe and Jon, but not Joseph.
• Jo* shows Jon, Joseph, and John Paul.

If your criteria value contains more than one word, you can use the wildcard in each word. For example, 'Jo* N*' shows Joe North, John Natt, Joshua Named, and so on.

Log Queries

You can run a log query in these ways:

• Standard suffix - Search for subnets using the standard suffix.
  • Examples: 192.168.0.0/16 (shows all records for 192.168.0.0 to 192.168.255.255 inclusive)

    or 192.168.1.0/24 (shows all records for 192.168.1.0 to 192.168.1.255 inclusive)

• Wildcard
  • Examples 192.168.2.* shows all records for 192.168.2.0 to 192.168.2.255 inclusive

    192.168.* shows all records for 192.168.0.0 to 192.168.255.255 inclusive

  • Search for a field with non-empty values only using field:*.

    Examples: src:*, severity:*, appi_name:*, protection_type:*