This topic covers the details and special cases when using wildcards, for example, within quoted search expressions and within phrase queries.
*matches 0 or more characters.
?matches exactly one character.
fail*matches fail, failure, fails, failed
e*ormatches error, extensor, eliminator, eor
error OR fail error AND fail*
(error OR fail) and debug error* OR (fail and debug) error? NOT fail
A full-text search expression such as
email@example.com is called a "phrase query" because it operates on multiple search terms: jsmith , @ , somewhere, . , com as opposed to a single term query such as "fail". In a phrase query, the Sumo Logic search language looks for the five terms in the email address adjacent to each other. So, you can search for things such as IP addresses or segments of IP addresses like 10.1.1.123, or email domains like @sumologic.com.
If you are searching using a phrase query, Sumo Logic currently does not support partial-term wildcards within the phrase, such as
jsmith@some*re.com. However, you can use a wildcard to represent a full term in the phrase, like this