topic Re: Escape a period in transforms regex to drop log? in Splunk Search

Escape a period in transforms regex to drop log?

reswob4 — Thu, 21 Nov 2019 19:03:10 GMT

I'm collecting DNS logs and I'm trying to drop all logs with sub.domain.com as the query. In my transforms.conf I have the following:

[dropdomain]
REGEX = sub.domain.com
DEST_KEY=queue
FORMAT=nullQueue

But those domains still show up in my index. I have this on both the HF and the Indexer for that sourcetype.

I also am collecting logs from windows DNS debug log. As you know those come across in (#)string(#)string(#)string(#) format. So when the above comes through one of those logs, I have (3)sub(6)domain(3)com(0) in my log. I'm trying to drop those also and here is my transforms.conf for that log:

[dropdomain]
REGEX = sub(6)domain(3)com
DEST_KEY=queue
FORMAT=nullQueue

But that isn't working either. Is my syntax correct? Do I need to escape the period or not? Do I escape the parenthesis or not?

Thanks.

(I'm sure this question has been asked before, but I have not found the right google-fu to get the answer)

Re: Escape a period in transforms regex to drop log?

richgalloway — Thu, 21 Nov 2019 19:41:28 GMT

Your syntax for both REGEX attributes is valid, but not necessarily "correct".

sub,domain.com will match "sub" followed by any character followed by "domain" followed by any character followed by "com". If you want to match dots, you need to escape them as in sub\.domain\.com.

sub(6)domain(3)com will match "sub", "6", "domain", "3", and "com" in that order and will create capture groups for '6' and '3'. To match parentheses you must escape the left paren as in sub\(6)domain\(3)com.

Re: Escape a period in transforms regex to drop log?

reswob4 — Thu, 21 Nov 2019 19:46:52 GMT

First, thank you for the tips.

And this is where I should have reviewed my post. I actually had

sub\.domain\.com

and

sub\(6\)domain\(3\)com

but missed the reformatting changes after post.

Your answer helps. I will try both of those things.

Re: Escape a period in transforms regex to drop log?

reswob4 — Fri, 22 Nov 2019 19:41:04 GMT

OK, this is how I got things to work. I used:

REGEX = \[.+?\]\s+\w+\s+.+?sub.+?domain.+?com

I think I got that syntax from somewhere, but I can't find the reference....