# Wildcard search not working as intended **URL:** \ **Category:** Kibana\ **Created:** [November 17, 2017, 8:18pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192 "2017-11-17T20:18:13Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [November 17, 2017, 8:18pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/1 "2017-11-17T20:18:13Z")
Hello, I am attempting to search my data to only show results for only three source ip ranges that is linked to action:drop but I am still seeing all source ips. Below are the several different search strings I've tried: ``` action:drop scrip:192.* scrip:10.* scrip:172.* action:drop scrip:"192.*" scrip:"10.*" scrip:"172." action:drop scrip:192.* OR scrip:10.* OR scrip:172.* ``` I've tried several other suggestions from researching online but still unable to only show results for the ip ranges in the search string. ---
**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\ **Post date:** [November 17, 2017, 9:38pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/2 "2017-11-17T21:38:09Z")
Hi @Feedy, > [@Feedy](#): > > scrip:192.\* OR scrip:10.\* OR scrip:172.\* If you just type that in the query bar, does it show you only results matching that ip pattern? ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [November 17, 2017, 9:53pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/3 "2017-11-17T21:53:15Z")
Hi Chris, I don't get any results back when I just type that in the query bar. ---
**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\ **Post date:** [November 17, 2017, 9:56pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/4 "2017-11-17T21:56:10Z")
Hi @Feedy, If you type `scrip:*`, do you see any results? Thanks, Chris ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [November 17, 2017, 10:01pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/5 "2017-11-17T22:01:40Z")
I apologize Chris. In my original post I mistyped the field name. It should be srcip and not scrip. So with that being said... when I do type srcip:192.\* OR srcip:10.\* OR srcip:172.\* it does show only results matching the ip pattern. ---
**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\ **Post date:** [November 17, 2017, 10:02pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/6 "2017-11-17T22:02:24Z")
Okay, awesome! Sounds like you're all set! ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [November 17, 2017, 10:05pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/7 "2017-11-17T22:05:38Z")
well it only works if I have action:drop set as a filter. When I type the following in the query bar it shows other ip ranges: action:drop srcip:192.168.\* OR srcip:10.\* OR srcip:172.\* so the only way to make this work is by adding the action field as a set filter and not in the query bar? ---
**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\ **Post date:** [November 17, 2017, 10:06pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/8 "2017-11-17T22:06:38Z")
What if you do: ```auto action:drop AND (srcip:192.168.* OR srcip:10.* OR srcip:172.*) ``` ---
**Author:** ![Feedy](https://avatars.discourse-cdn.com/v4/letter/f/76d3ee/32.png) [@Feedy](https://discuss.elastic.co/u/Feedy)\ **Post date:** [November 17, 2017, 10:07pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/9 "2017-11-17T22:07:40Z")
Still shows all ip ranges ---
**Author:** ![chrisronline](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrisronline/32/28230_2.png) [@chrisronline](https://discuss.elastic.co/u/chrisronline)\ **Post date:** [November 17, 2017, 10:11pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/10 "2017-11-17T22:11:09Z")
It seems to work for me. Are there any errors in the console? If not, can you look at the `_msearch` request in the network tab and paste the request body? ![05 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/b/ab182dd717c3ed8783d48e3d47a950eddcef332b.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 15, 2017, 10:11pm UTC](https://discuss.elastic.co/t/wildcard-search-not-working-as-intended/108192/11 "2017-12-15T22:11:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.