Refine your search:

Transforms.conf: Need help combining regex (simple)?

1
1

I'm sure this is really simple but I've been unable to figure out the syntax to combine these 2 regexes in my transforms.conf. Thus, I've split them into two separate stanzas:

[first]
REGEX=(?m)(ComputerName=HerComputer)
DEST_KEY=_MetaData:Index
FORMAT=new

[second]
REGEX=(?m)(ComputerName=HisLaptop)
DEST_KEY=_MetaData:Index
FORMAT=new

asked 08 Jun '11, 12:40

the_wolverine's gravatar image

the_wolverine ♦
4.3k●5●8●43
accept rate: 50%

edited 08 Jun '11, 12:41

One Answer:
oldestnewestmost voted
3

How about this?

[combined]
REGEX=(?m)ComputerName=(HerComputer|HisLaptop)
DEST_KEY=_MetaData:Index
FORMAT=new
link

answered 08 Jun '11, 12:49

ziegfried's gravatar image

ziegfried ♦
7.1k●1●3●15
accept rate: 53%

edited 08 Jun '11, 12:49

Thanks :-)

(09 Jun '11, 22:01) the_wolverine ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

learn more about Markdown

Tags:

×311
×244
×94

Asked: 08 Jun '11, 12:40

Seen: 570 times

Last updated: 09 Jun '11, 22:01

Related questions

This AND That regex in transforms.conf?

Regex using transforms.conf

REGEX transforms.conf, NOT operator

Multiple Values per Event - transforms.conf regex

Certain REGEX strings in transforms.conf will fail

REGEX problem transforms.conf WinEventLog:Security

Regex for transforms.conf for splitting string

Copyright © 2005-2012 Splunk, Inc. All rights reserved.