Filtering with Wildcard & Spaces

Graylog Central (peer support)
1

I have a query that I am having issues pulling any results with.

source:“server” AND ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2”

I need to be able to see any ObjectName within SubFolder2. I have tried the following:

ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2”
ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2*”
ObjectName:"E:\RootFolder\Billing Department\SubFolder1\SubFolder2\"
ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2”
ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2”*
ObjectName:“E:\RootFolder\Billing Department\SubFolder1\SubFolder2*”

The first line gives me only the Objects with the exact name and nothing more. I think the issue I am having is with the space in Billing Department and the quotes. I am not sure how to format to account for that space.

2

Have you looked at the docs re: escaping characters: Search query language — Graylog 4.0.0 documentation? Offhand, I’d say you’ll probably have to do a lot of escaping with a \ in front of any of the characters mentioned in doc.

3

Escaping characters helped a little. I can’t believe I missed that. Here is what I have.

source:“server” AND ObjectName:“E:\RootFolder\Billing Department\Subfolder1\Subfolder2”*

This only gets me to Subfolder2, but nothing below that. I have tried putting the asterisk in multiple locations on the end to no avail.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.