1. Using Oracle Log Analytics Search
  2. Explore Log Data
  3. Write Search Queries
  4. Use Keywords, Phrases, and Wildcards

Use Keywords, Phrases, and Wildcards

String queries can include keywords and phrases. A keyword is a single word (for example, database), while a phrase refers to multiple words, enclosed in single (‘ ‘) or double (“ “) quotes (for example, ‘database connection’). If you specify a keyword or a phrase in your query, then all log entries containing the specified keyword or phrase are returned after the query is run.

The Oracle Log Analytics search language also supports special pattern mapping. In other words, you can use wildcard characters, such as asterisk (*), question mark (?), and percentage (%), to complete keywords.

The following table lists the supported wildcard characters and provides a brief description of each.

Wildcard Character Description

?

Use this character to match exactly one character of the possibilities to the keyword. For example, if you enter host?, then the keyword host1 is considered to be a match, while host.foo.bar is not.

* or %

Use either of these characters to match 0 or more characters of the possibilities, to the keyword. For example, if you enter host* or host%, then host1 and host.foo.bar are considered to match the keyword. Similarly, if you enter %host%, then ahostb and myhost are considered to match the specified keyword.

You can specify multiple keywords. For example, database and connection. Logs containing the words database and connection (but not necessarily together) are returned. However, these words need not necessarily occur consecutively. However, by enclosing the words in quotes and including them in the query string as a phrase (‘database connection’, for example), then only those logs containing the phrase ‘database connection’ are returned. To see how to use multiple keywords, see Use Boolean Expressions.

When specifying a keyword or phrase, remember the following:

  • Keywords and phrase strings are not case-sensitive.

  • Keywords which are not enclosed within quotes must contain only alphanumeric characters, underscore (_), and wildcard characters (*, %, and ?).

  • Keyword searches where the substring could be interpreted as a separate directive should be specific within quotes. For example, to search for the string and, you will have to enter it within single quotes (‘and’) to prevent the system from picking up its Boolean meaning.

Note:

To use wildcards with the message field, you must also use LIKE or LIKE IN. Following are examples of using wildcards with message.
ORA-* AND message LIKE 'connection* error*'
ORA-* AND message LIKE IN ('tablesp*','connection* error*')