Hi guys!
Sorry for the misleading question, but does is anyone really good with regex? I am trying to search for "deleted/moved" using regex and I know you can't do it in that exact format. Anyone know the proper syntax?
Thanks for your help!
All you have to do is escape the slash. "deleted\/moved" worked for me on regex101.com. If it doesn't work for you, please provide some sample data.
All you have to do is escape the slash. "deleted\/moved" worked for me on regex101.com. If it doesn't work for you, please provide some sample data.
Thanks alot guys! Works like a dream!
Please accept the answer.
Your regex says "for OOID", your event says "out from OOID"
Hi and thanks for your reply.
I am trying to run :
| rex "(?<action>created|updated|deleted) for OOID:(?<OOID>\S+?)
I am trying to get "deleted/moved" from the below log:
4/13/15
11:26:13.215 AM
2015-04-13 11:26:13,215 DEBUG [actions.logging.DocumentLoggingAction] [http-apr-8080-exec-4] ADP Portal Document workspace://SpacesStore/0e13591d-ebcc-478b-a429-71d27af861ff is deleted/moved out from OOID:G356YP8WRCC3GTQK, AOID:G36H1Z9E4E0QZ562, with Category: 2200001275, subCategory: 2200001311
I tried just entering in as you said with the "deleted/moved" and it does not pick up that up in Splunk
Your list of possible actions does not include "deleted/moved". Also, the anchor "for OOID" doesn't match the sample event. Try this:
... | rex "(?<action>created|updated|deleted\/moved) out from OOID:(?<OOID>[^,]+)" | ...
I suspect, however, the text "out from OOID" changes with the action. In that case, you may want something like:
... | rex "(?<action>created|updated|deleted\/moved) (?:.*) OOID:(?<OOID>[^,]+)" | ...