@woodcock @somesoni2 Here is more context: Actually our setup flow is little different LIKE below. We are NOT using UF in out setup. Endpoints(Includes all network appliances and Linux servers etc..)  ---> Central syslog-ng ---> Sending to Splunk HF on a TCP Port(At this point we have TCP input setup with sourcetype as syslog and source as syslog_feed). Unfortunately we don't have option to install Splunk UF on syslog-ng and only way we can receive data is through TCP port onto Splunk HF My requirement now is identify /var/log/secure events out of the whole feed send to a different index based on the event format using REGEX. Is there a specific Regex that can identify all the secure logs that I can use in my transforms below. [linux_secure] SOURCE_KEY = _raw REGEX = ***Need REX to identify /var/log/secure events**** DEST_KEY = _MetaData:Index FORMAT = abc_index   ... View more

Actually we DONT have source separation as well. All the data is through syslog and source name is defined to a static name in our input. Basically source as syslog_feed and source type as syslog, that is where the challenging piece is. I need to now know the pattern for the secure logs and make use of the REGEX ... View more