Splunk Search

How to search for a "deleted/moved" in Regex?

splunkman341
Communicator

Hi guys!

Sorry for the misleading question, but does is anyone really good with regex? I am trying to search for "deleted/moved" using regex and I know you can't do it in that exact format. Anyone know the proper syntax?

Thanks for your help!

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

All you have to do is escape the slash. "deleted\/moved" worked for me on regex101.com. If it doesn't work for you, please provide some sample data.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

All you have to do is escape the slash. "deleted\/moved" worked for me on regex101.com. If it doesn't work for you, please provide some sample data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

splunkman341
Communicator

Thanks alot guys! Works like a dream!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please accept the answer.

---
If this reply helps you, Karma would be appreciated.

martin_mueller
SplunkTrust
SplunkTrust

Your regex says "for OOID", your event says "out from OOID"

splunkman341
Communicator

Hi and thanks for your reply.

I am trying to run :

 | rex "(?<action>created|updated|deleted) for OOID:(?<OOID>\S+?)

I am trying to get "deleted/moved" from the below log:

4/13/15 
11:26:13.215 AM 
 2015-04-13 11:26:13,215  DEBUG [actions.logging.DocumentLoggingAction] [http-apr-8080-exec-4] ADP Portal Document workspace://SpacesStore/0e13591d-ebcc-478b-a429-71d27af861ff is deleted/moved out from OOID:G356YP8WRCC3GTQK, AOID:G36H1Z9E4E0QZ562, with Category: 2200001275, subCategory: 2200001311

I tried just entering in as you said with the "deleted/moved" and it does not pick up that up in Splunk

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your list of possible actions does not include "deleted/moved". Also, the anchor "for OOID" doesn't match the sample event. Try this:

... | rex "(?<action>created|updated|deleted\/moved) out from OOID:(?<OOID>[^,]+)" | ...

I suspect, however, the text "out from OOID" changes with the action. In that case, you may want something like:

... | rex "(?<action>created|updated|deleted\/moved) (?:.*) OOID:(?<OOID>[^,]+)" | ...
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...