Wildcard query with a file path - Search for c:\users\public*

Elastic Stack Kibana
1

Hi, I'm trying to run a query similar to below that has a file path in it but keep getting this error: Discover: Expected "*", "", [\ \t\r\n] or end of input but ":" found. I've tried adding those but nothing.

Any suggestions on how to do this?

event_id:1 AND event_data.Image:c:\\users\\public*

Thanks

2

Hey @uklipse, you'll have to escape the : as well, so event_data.Image.keyword:c\:\\users\\public\\*

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.