topic Re: Why does PREAMBLE_REGEX work on Windows Splunk but not Linux Splunk? in Splunk Search

Why does PREAMBLE_REGEX work on Windows Splunk but not Linux Splunk?

andrewtrobec — Fri, 28 Jul 2017 09:34:31 GMT

Hello,

I am currently using the following REGEX for PREAMBLE_REGEX in props.conf which works on Splunk 6.4.x running on Windows:

(^|[\r\n])(Job\.Description[^\r\n]+|String[^\r\n]+)

This is used to tell Splunk to skip the second and third lines of log files which always start:

Job.Description,Job.NumJobWaitEvents...
String,Integer,Integer...

I've since migrated my app to a Splunk 6.4.x instance running on Linux, but it doesn't work anymore (the lines aren't ignored). What changes should I be looking out for to ensure that the regular expression works in Linux as well?

Thank you and best regards,

Andrew

Re: Why does PREAMBLE_REGEX work on Windows Splunk but not Linux Splunk?

cpetterborg — Fri, 28 Jul 2017 09:53:55 GMT

Try:

^(Job\.Description.+|String,.+)$

It should work the same way as your regex, but it's simpler. That might make a difference.

Re: Why does PREAMBLE_REGEX work on Windows Splunk but not Linux Splunk?

andrewtrobec — Thu, 03 Aug 2017 15:26:17 GMT

Thanks for the input. The REGEX works but doesn't solve the problem. I've found what I was looking for here:

https://answers.splunk.com/answers/209824/how-to-get-splunk-to-ignore-the-second-line-of-a-l.html

Suggestion was to use a null-queue transform by modifying props.conf and transforms.conf