Can anyone help resolve the issue with my search for events relating to USB violations

[wlwilliams01]

[DavidHourani]

Hi @wlwilliams01,

Use a labeled capturing group instead of (?.) and (?0x0) as shown here :
https://www.regular-expressions.info/named.html
which should look something like this :

(?<name>group) 

Also you can use the following site to validate your regex:
www.regex101.com

Let me know if it helps.

Cheers,
David

[tom_frotscher]

Hi,

you can not just use (?.) as a group. You need to add a name for at least one group like this:

(?<name>.+)

which would extract the results of the group to a field called "name" in Splunk. If you want to match everything in a group without giving a name you might be able to use (?:).

Greetings

Tom