https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568739#M10114 <P>Yeah, I know that but that covers regular regex syntax (which is more-or less PCRE) and escaping special characters. And equals sign is not special (at least in regex).</P><P>As I said, I found a mention about escaping the equals sign on few posts on community but nothing in official docs <span class="lia-unicode-emoji" title=":confused_face:">😕</span></P> Tue, 28 Sep 2021 14:17:46 GMT PickleRick 2021-09-28T14:17:46Z https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568727#M10110 <P>I'm trying to match events in transforms.conf on key=value strings. (like EventCode=103 and so on).</P><P>It wouldn't work unless I did escape the equals sign with backslash. So config entry like</P><PRE>REGEX=ComputerName=whatever.domain.com</PRE><P>Doesn't seem to work, but</P><PRE>REGEX=ComputerName\=whatever.domain.com</PRE><P>&nbsp;does.</P><P>And I generally don't mind it but I would love to see a piece of docs that says that the equals sign has to be ascaped. Normally it doesn't so I have no idea if it's something to do with regex itself, or with conf file parsing.</P><P>Can anyone point me to a proper doc?</P> Tue, 28 Sep 2021 13:45:01 GMT https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568727#M10110 PickleRick 2021-09-28T13:45:01Z https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568732#M10111 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231884">@PickleRick</a>&nbsp;Hey, There is not any exact document for only a "=" but you can find a doc for regex and you can get more info with this:<BR /><A href="https://docs.splunk.com/Documentation/SCS/current/Search/Escapecharacters" target="_self">https://docs.splunk.com/Documentation/SCS/current/Search/Escapecharacters</A>&nbsp;<BR />Also, If this reply helps you, an upvote would be appreciated.</P> Tue, 28 Sep 2021 13:52:47 GMT https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568732#M10111 ashvinpandey 2021-09-28T13:52:47Z https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568739#M10114 <P>Yeah, I know that but that covers regular regex syntax (which is more-or less PCRE) and escaping special characters. And equals sign is not special (at least in regex).</P><P>As I said, I found a mention about escaping the equals sign on few posts on community but nothing in official docs <span class="lia-unicode-emoji" title=":confused_face:">😕</span></P> Tue, 28 Sep 2021 14:17:46 GMT https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568739#M10114 PickleRick 2021-09-28T14:17:46Z https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568756#M10117 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231884">@PickleRick</a>&nbsp;Here is the official link from splunk where the list of all the special characters are mentioned, Also the "equal to" sign is present:<BR /><A href="https://docs.splunk.com/Documentation/StyleGuide/current/StyleGuide/Specialcharacters" target="_self">https://docs.splunk.com/Documentation/StyleGuide/current/StyleGuide/Specialcharacters</A>&nbsp;<BR />Also, If this reply helps you, an upvote would be appreciated.</P> Tue, 28 Sep 2021 14:42:02 GMT https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568756#M10117 ashvinpandey 2021-09-28T14:42:02Z https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568762#M10118 <P>Well yes, but it's a style guide, not a conf file spec <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 28 Sep 2021 15:01:39 GMT https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568762#M10118 PickleRick 2021-09-28T15:01:39Z https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568816#M10119 Hi<BR />If/when you have found anything enough clear or confusing on docs you should leave comment on that page. Doc team are willing to clarifying those on docs.<BR />r. Ismo Tue, 28 Sep 2021 17:48:38 GMT https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568816#M10119 isoutamo 2021-09-28T17:48:38Z https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568819#M10121 <P>Yeah, I know. I already "fixed" a thing or two on the doc pages <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 28 Sep 2021 18:33:11 GMT https://community.splunk.com/t5/Splunk-Enterprise/equals-sign-in-regexes/m-p/568819#M10121 PickleRick 2021-09-28T18:33:11Z