topic Re: What is the regular expression for these Event ID codes? in Getting Data In

What is the regular expression for these Event ID codes?

chanamoluk — Thu, 12 Jan 2017 16:21:52 GMT

Client needs to push these event codes through Heavy Forwarder to Splunk Cloud.
So please help in creating REGEX for filtering the below Event ID's in transforms.conf and props.conf
transforms.conf

1100,1101,1102,1104,1105,1108
4624-4627,4634,4646-4668,4670-4672,4675,4690-4691,4698-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797-4803

Re: What is the regular expression for these Event ID codes?

hunters_splunk — Thu, 12 Jan 2017 17:14:26 GMT

Hi chanamoluk,

The IDs you provided are just samples - a small subset of all the event IDs with the same patterns you want to capture, right?
If so, I think there are two primary patterns: /d{4} and /d{4}-/d{4}.

You can then filter out events with these IDs using the following example stanzas - just for your reference.

props.conf

[EventLog:System]
TRANSFORMS = null_queue_filter

transforms.conf

[null_queue_filter]
REGEX = (?m)^EventID=(/d{4}|/d{4}-/d{4})
DEST_KEY = queue
FORMAT = nullQueue

Hope this helps. Thanks!
Hunter

Re: What is the regular expression for these Event ID codes?

chanamoluk — Thu, 12 Jan 2017 17:31:21 GMT

1100,1101,1102,1104,1105,1108
4624-4627,4634,4646-4668,4670-4672,4675,4690-4691,4698-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797-4803
4817-4820,4865-4900,4902,4904-4908,4911-4913,4928-4937,4944-4952,4954,4956-4958,4964,4976,4985
5031,5063-5070,5120,5136-5145,5148-5159,5168,5376-5377,5440-5444,5446-5453,5456-5468,5471-5474,5477,5632-5633,5888-5889
6144-6145,6272-6280

This are the list of event codes data i want to send to splunk cloud and for which i need regular expressions.

please help me in creating regular expressions... help will appreciated...