topic Re: Regex needed for sourcetype forcing in Knowledge Management

Regex needed for sourcetype forcing

maria1991 — Tue, 18 Jan 2022 13:16:21 GMT

Hi All

I have a sourcetype in which we have some events with a keyword like asdf. In some events it comes in between and some events at the end.

I need to forward all these logs to another sourcetype with props and transforms.

[generic_sourcetype_routing_asdf]
REGEX =
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::asdf_logs

props.conf

[current_sourcetype]
TRANSFORMS-sourcetype_routing = generic_sourcetype_routing_asdf

In the REGEX part I would like to know if only keeping asdf or *asdf * would work. I can't put the regex for complete log format since there are multiple formats. So I need to inform splunk to pass any event with asdf anywhere in it should be forwarded to the new one. Please suggest.

Thanks

Maria Arokiaraj

Re: Regex needed for sourcetype forcing

richgalloway — Tue, 18 Jan 2022 13:38:21 GMT

*asdf* is not a valid regular expression. Use asdf. There is an implied wildcard at the beginning and end of every regex unless specified otherwise with ^ and/or $.

regex101.com is a great place to test expressions.

Re: Regex needed for sourcetype forcing

maria1991 — Wed, 19 Jan 2022 08:55:32 GMT

Just adding the keyword asdf worked for me 🙂 Thanks