Have Multiple REGEX in Transforms

Hi All,

I was wondering how you go about sending different criteria to the null que and whether the below would work?

----tranforms.conf----

[WindowsLogonEvent675]
REGEX = (?msi)EventCode=4624.Account Name:\s(-)
REGEX = (?msi)^EventCode=(632|4719|4728|4729|4670)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

Or should the be done like below (with the same [xxxxx]?

----tranforms.conf----

[WindowsLogonEvent675]
REGEX = (?msi)EventCode=4624.Account Name:\s(-)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

----tranforms.conf----

[WindowsLogonEvent675]
REGEX = (?msi)^EventCode=(632|4719|4728|4729|4670)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

Sorry for the vague question.... but I hope someone understands what I mean...

Thanks

David

asked 07 Mar '11, 21:53

Scarecrowddb
9●5
accept rate: 0%

One Answer:

oldest newest most voted

You cannot have multiple REGEX parameters in transforms.conf for the same stanza. You almost have it correct with breaking this into 2 transforms, but they need to have unique names. So here's how you would split into 2 and call them from props.conf

-----props.conf-----

[mysourcetype]
TRANSFORMS-foo = WindowsLogonEvent675_Part1, WindowsLogonEvent675_Part2

-----transforms.conf-----

WindowsLogonEvent675_Part1]
REGEX = (?msi)EventCode=4624.Account Name:\s(-)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

[WindowsLogonEvent675_Part2]
REGEX = (?msi)^EventCode=(632|4719|4728|4729|4670)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

link

answered 07 Mar '11, 22:14

hulahoop ♦
2.5k●3●2●39
accept rate: 40%

edited 16 Mar '11, 07:00

OK, thanks heaps for your help!

(09 Mar '11, 00:01) Scarecrowddb

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

forwarder ×400
regex ×242
filter ×94
null ×19

Asked: 07 Mar '11, 21:53

Seen: 948 times

Last updated: 16 Mar '11, 07:00

Have Multiple REGEX in Transforms

Follow this question

Splunk Resources

Related questions