https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93756#M24145 <P>It's related to the formatting on this forum; you'll have to either double-up any backslashes, or indent them so that the renderer interprets it as "code".</P> Mon, 09 Jul 2012 16:51:53 GMT sowings 2012-07-09T16:51:53Z https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93753#M24142 <P>The goal is to take my ohs logs and dump all except entries with IP addresses. IP's w/o images that is. I can get it to only give me the ip addresses but I also want to dump all references to images. Any ideas on how the end of the regex should look?</P> <P>props.conf</P> <P>[source::/u01/app/oracle/Middleware/asinst_1/diagnostics/logs/OHS/ohs1/*]<BR /> TRANSFORMS-set = setnull,setparsing</P> <P>transforms.conf</P> <P>[setnull]<BR /> REGEX = .<BR /> DEST_KEY = queue<BR /> FORMAT = nullQueue</P> <P>[setparsing]<BR /> REGEX = \b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b [^.(jpg|gif|png)]<BR /> DEST_KEY = queue<BR /> FORMAT = indexQueue</P> Mon, 09 Jul 2012 13:17:58 GMT https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93753#M24142 jlmoldan 2012-07-09T13:17:58Z https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93754#M24143 <P>I'm guessing your formatting is a bit broken. Could you please indent all code sections that should be shown as-is with 4 spaces at the start of the line, so that your regex is shown correctly.</P> Mon, 09 Jul 2012 13:49:07 GMT https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93754#M24143 Ayn 2012-07-09T13:49:07Z https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93755#M24144 <P>I have no idea what that means. (sorry, new-er to Splunk)</P> Mon, 09 Jul 2012 13:55:54 GMT https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93755#M24144 jlmoldan 2012-07-09T13:55:54Z https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93756#M24145 <P>It's related to the formatting on this forum; you'll have to either double-up any backslashes, or indent them so that the renderer interprets it as "code".</P> Mon, 09 Jul 2012 16:51:53 GMT https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93756#M24145 sowings 2012-07-09T16:51:53Z https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93757#M24146 <P>Do you have a few example events?</P> Thu, 21 Apr 2016 13:54:33 GMT https://community.splunk.com/t5/Splunk-Search/regex-help-transforms-conf/m-p/93757#M24146 agarrison 2016-04-21T13:54:33Z