topic Re: What's wrong with this REGEX? in Getting Data In

What's wrong with this REGEX?

danielbb — Fri, 23 Jan 2026 23:03:19 GMT

I have this "innocent" regex to send to the nullQueue in transforms.conf, and it doesn't work. I'm scratching my head for two days, what can this be?

REGEX = \} OnChange

Re: What's wrong with this REGEX?

livehybrid — Fri, 23 Jan 2026 19:44:11 GMT

Hi @danielbb

Are you able to post a sample of the event you are working with and also how you are calling the REGEX/transform?

Does this make any difference?

REGEX = \}\sOnChange

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: What's wrong with this REGEX?

gcusello — Sat, 24 Jan 2026 06:36:53 GMT

HI @danielbb ,

as also @livehybrid said, it's mandatory to have a sample of your logs to check your regex, even if it's very simple.

One additional question: what's the flow of your data?

To correctly work this transformation must be located in the first full Splunk instance where logs pass through, in other words in the first Heavy Forwarder.

Ciao.

Giuseppe

Re: What's wrong with this REGEX?

danielbb — Mon, 26 Jan 2026 15:58:40 GMT

Hi @livehybrid ,

Thank you for the great response.

It seemed to have been a simple typo on my side.

Do you know how I could rework this REGEX to work for multiple phrases (about 50 or so)?

Is it best practice to do it all in one REGEX statement or split it into multiple transforms.conf stanzas?

Re: What's wrong with this REGEX?

PickleRick — Mon, 26 Jan 2026 18:24:12 GMT

Well, performance-wise one transform with a well-crafted regex should be faster than several dozens of separate ones. The question is whether you'll need to maintain that later because a single humongous regex can be very confusing and prone to errors on edit.

Re: What's wrong with this REGEX?

danielbb — Thu, 29 Jan 2026 17:35:02 GMT

That sounds great, @PickleRick how long can the REGEX string be? and is there any way to "beautify" it instead of using constant pipes "|" so it's more readable?