GRAYLOG - Chapter 6, Exercise 3 Solution ========================================================== Matching Every Subcategory Under CC.Bullhorn PROBLEM ------- Write a query, using this chapter's own real field and its trailing- wildcard behavior, that matches every legacy Perl/CGI log line categorized anywhere under CC.Bullhorn. SOLUTION -------- This chapter's own real field is categoryName, using a dot-joined structure (example given: CC.Bullhorn.DB). The chapter noted this structure supports a trailing wildcard the same way class does (per Chapter 1's own trailing-wildcard-only rule): categoryName:CC.Bullhorn.* ANSWER: categoryName:CC.Bullhorn.* ---- WHY THIS WORKS AS AN ANSWER This is a direct application of this chapter's own real worked example (categoryName:CC.Bullhorn.* was given as the exact illustration of matching every subcategory under CC.Bullhorn at once), which itself relies on Chapter 1's own trailing-wildcard rule - since the wildcard sits at the END of a known, literal prefix (CC.Bullhorn.), it's a genuinely valid trailing wildcard, not the unsupported leading kind.