Hi everyone. Previous replies to this topic will work but a threat actor can exploit spaces, carriage returns, and Splunk comments to bypass your search query looking for delete commands. Please use this query if you want to account for that: index=_audit action=search | regex search="\\|(\\s|\\n|\\r|(```[\\s\\S]*```))*delete"   ... View more