1. Logpoint Service Desk
  2. Community
  3. SIEM - Searching & Analytics

RegEx in fulltext search?

Avatar
Follow
0

I want to search an absolute windows path name to NOT start with A, B, C drive letters.

I tried queries like this:

path in ['[D-Z]:\\*']

but this doesnt work. Any ideas?

Share This Post:

2 comments

Date Votes
0
Avatar
Lau Frejstrup Suhr

A viable workaround is to use the regex process to put it into a new field and check that it as populated like this:

path=* | process regex("(?P<path_out>[D-Z]:\\.*?)",path) | filter path_out=*

/Lau

0
Avatar
Kai Gustafson

I want to search an absolute windows path name to NOT start with A, B, C drive letters.

I tried queries like this:

path in ['[D-Z]:\\*']

but this doesnt work. Any ideas?

a quick way ;)
-path="A:*" -path="B:*" -path="C:*"

-Kai

Please sign in to leave a comment.