Filtering with Wildcard & Spaces

I have a query that I am having issues pulling any results with.

source:“server” AND ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2”

I need to be able to see any ObjectName within SubFolder2. I have tried the following:

ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2”
ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2*”
ObjectName:"E:\RootFolder\Billing Department\SubFolder1\SubFolder2\"
ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2”

ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2”*
ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2*”

The first line gives me only the Objects with the exact name and nothing more. I think the issue I am having is with the space in Billing Department and the quotes. I am not sure how to format to account for that space.

Have you looked at the docs re: escaping characters: Search query language — Graylog 4.0.0 documentation? Offhand, I’d say you’ll probably have to do a lot of escaping with a \ in front of any of the characters mentioned in doc.

Escaping characters helped a little. I can’t believe I missed that. Here is what I have.

source:“server” AND ObjectName:“E:\RootFolder\Billing Department\Subfolder1\Subfolder2”*

This only gets me to Subfolder2, but nothing below that. I have tried putting the asterisk in multiple locations on the end to no avail.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.