How to search for a "deleted/moved" in Regex?

[splunkman341]

Hi guys!

Sorry for the misleading question, but does is anyone really good with regex? I am trying to search for "deleted/moved" using regex and I know you can't do it in that exact format. Anyone know the proper syntax?

Thanks for your help!

[richgalloway · Accepted solution]

All you have to do is escape the slash. "deleted\/moved" worked for me on regex101.com. If it doesn't work for you, please provide some sample data.

[splunkman341]

Thanks alot guys! Works like a dream!

[richgalloway]

Please accept the answer.

[martin_mueller]

Your regex says "for OOID", your event says "out from OOID"

[splunkman341]

Hi and thanks for your reply.

I am trying to run :

 | rex "(?<action>created|updated|deleted) for OOID:(?<OOID>\S+?)

I am trying to get "deleted/moved" from the below log:

4/13/15 
11:26:13.215 AM 
 2015-04-13 11:26:13,215  DEBUG [actions.logging.DocumentLoggingAction] [http-apr-8080-exec-4] ADP Portal Document workspace://SpacesStore/0e13591d-ebcc-478b-a429-71d27af861ff is deleted/moved out from OOID:G356YP8WRCC3GTQK, AOID:G36H1Z9E4E0QZ562, with Category: 2200001275, subCategory: 2200001311

I tried just entering in as you said with the "deleted/moved" and it does not pick up that up in Splunk

[richgalloway]

Your list of possible actions does not include "deleted/moved". Also, the anchor "for OOID" doesn't match the sample event. Try this:

... | rex "(?<action>created|updated|deleted\/moved) out from OOID:(?<OOID>[^,]+)" | ...

I suspect, however, the text "out from OOID" changes with the action. In that case, you may want something like:

... | rex "(?<action>created|updated|deleted\/moved) (?:.*) OOID:(?<OOID>[^,]+)" | ...