0

I am trying to search for all events which contain a UUID as part of a request url. Here is my query:

.... | regex requestURI=*/employee/[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}*

It gives error as:

Unknown search command '0'

What's the mistake I am making?

Mandroid
  • 6,200
  • 12
  • 64
  • 134

1 Answers1

1

Try using " instead of *

.... | regex requestURI="/employee/[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}"

Now talking about the regex itself, but there is already a question for that. Check the answers here for the RegEx: Searching for UUIDs in text with regex Some important points like case sensitivity etc. are discussed there.

CravingMender9
  • 51
  • 4