topic Re: How to search for a "deleted/moved" in Regex? in Splunk Search

How to search for a "deleted/moved" in Regex?

splunkman341 — Mon, 13 Apr 2015 15:07:57 GMT

Hi guys!

Sorry for the misleading question, but does is anyone really good with regex? I am trying to search for "deleted/moved" using regex and I know you can't do it in that exact format. Anyone know the proper syntax?

Thanks for your help!

Re: How to search for a "deleted/moved" in Regex?

richgalloway — Mon, 13 Apr 2015 15:19:45 GMT

All you have to do is escape the slash. "deleted\/moved" worked for me on regex101.com. If it doesn't work for you, please provide some sample data.

Re: How to search for a "deleted/moved" in Regex?

splunkman341 — Mon, 13 Apr 2015 15:32:48 GMT

Hi and thanks for your reply.

I am trying to run :

 | rex "(?<action>created|updated|deleted) for OOID:(?<OOID>\S+?)

I am trying to get "deleted/moved" from the below log:

4/13/15 
11:26:13.215 AM 
 2015-04-13 11:26:13,215  DEBUG [actions.logging.DocumentLoggingAction] [http-apr-8080-exec-4] ADP Portal Document workspace://SpacesStore/0e13591d-ebcc-478b-a429-71d27af861ff is deleted/moved out from OOID:G356YP8WRCC3GTQK, AOID:G36H1Z9E4E0QZ562, with Category: 2200001275, subCategory: 2200001311

I tried just entering in as you said with the "deleted/moved" and it does not pick up that up in Splunk

Re: How to search for a "deleted/moved" in Regex?

martin_mueller — Mon, 13 Apr 2015 15:44:04 GMT

Your regex says "for OOID", your event says "out from OOID"

Re: How to search for a "deleted/moved" in Regex?

richgalloway — Mon, 13 Apr 2015 15:49:18 GMT

Your list of possible actions does not include "deleted/moved". Also, the anchor "for OOID" doesn't match the sample event. Try this:

... | rex "(?<action>created|updated|deleted\/moved) out from OOID:(?<OOID>[^,]+)" | ...

I suspect, however, the text "out from OOID" changes with the action. In that case, you may want something like:

... | rex "(?<action>created|updated|deleted\/moved) (?:.*) OOID:(?<OOID>[^,]+)" | ...

Re: How to search for a "deleted/moved" in Regex?

splunkman341 — Mon, 13 Apr 2015 15:58:00 GMT

Thanks alot guys! Works like a dream!

Re: How to search for a "deleted/moved" in Regex?

richgalloway — Mon, 13 Apr 2015 16:49:38 GMT

Please accept the answer.