Refine your search:

1
1

I'm sure this is really simple but I've been unable to figure out the syntax to combine these 2 regexes in my transforms.conf. Thus, I've split them into two separate stanzas:

[first]
REGEX=(?m)(ComputerName=HerComputer)
DEST_KEY=_MetaData:Index
FORMAT=new

[second]
REGEX=(?m)(ComputerName=HisLaptop)
DEST_KEY=_MetaData:Index
FORMAT=new

asked 08 Jun '11, 12:40

the_wolverine's gravatar image

the_wolverine ♦
4.3k5843
accept rate: 50%

edited 08 Jun '11, 12:41


One Answer:

How about this?

[combined]
REGEX=(?m)ComputerName=(HerComputer|HisLaptop)
DEST_KEY=_MetaData:Index
FORMAT=new
link

answered 08 Jun '11, 12:49

ziegfried's gravatar image

ziegfried ♦
7.1k1315
accept rate: 53%

edited 08 Jun '11, 12:49

Thanks :-)

(09 Jun '11, 22:01) the_wolverine ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×311
×244
×94

Asked: 08 Jun '11, 12:40

Seen: 570 times

Last updated: 09 Jun '11, 22:01

Copyright © 2005-2012 Splunk, Inc. All rights reserved.