https://community.splunk.com/t5/Getting-Data-In/keep-some-events-and-discard-the-rest/m-p/56031#M10945 <P>I'm sure you can optimize your regex to match multiple criteria. Can you provide examples of the events you're trying to filter?</P> Wed, 05 Jun 2013 23:44:12 GMT carmackd 2013-06-05T23:44:12Z https://community.splunk.com/t5/Getting-Data-In/keep-some-events-and-discard-the-rest/m-p/56030#M10944 <P>i have a huge log file with events, i need to keep around 20-30 events and discard the rest. I have used a stanza in transforms.conf with a REGEX=(MATCH-1 | MATCH-2 | MATCH-3 |..|..|... MATCH-N), such that the events which match with REGEX are in and the rest are sent to nullQueue. </P> <P>Is there a better way to write instead of writing (MATCH-1 | MATCH-2 | MATCH-3 |..|..|... MATCH-N) in the REGEX?</P> <P>Please guide..</P> Wed, 05 Jun 2013 16:32:22 GMT https://community.splunk.com/t5/Getting-Data-In/keep-some-events-and-discard-the-rest/m-p/56030#M10944 trkalva 2013-06-05T16:32:22Z https://community.splunk.com/t5/Getting-Data-In/keep-some-events-and-discard-the-rest/m-p/56031#M10945 <P>I'm sure you can optimize your regex to match multiple criteria. Can you provide examples of the events you're trying to filter?</P> Wed, 05 Jun 2013 23:44:12 GMT https://community.splunk.com/t5/Getting-Data-In/keep-some-events-and-discard-the-rest/m-p/56031#M10945 carmackd 2013-06-05T23:44:12Z