https://community.splunk.com/t5/Splunk-Search/case-insensitive-transforms-conf/m-p/19406#M2940 <P>works like a charm, thanks</P> Mon, 30 May 2011 19:04:51 GMT EricPartington 2011-05-30T19:04:51Z https://community.splunk.com/t5/Splunk-Search/case-insensitive-transforms-conf/m-p/19404#M2938 <P>is there a way to have case sensitive matches for transforms.conf?</P> <P>I have a regex setting the sourcetype and index but i require matching some words with case insensitivity. is there a way to match insensitive as you would for a normal regex (i)</P> <P>REGEX=:\d+\s([O|o|S|s|G|g][HOST|host].*[ABC|abc])[\w\d]+\s[</P> <P>i would rather use a case insensitive regex if possible.</P> Mon, 30 May 2011 18:46:40 GMT https://community.splunk.com/t5/Splunk-Search/case-insensitive-transforms-conf/m-p/19404#M2938 EricPartington 2011-05-30T18:46:40Z https://community.splunk.com/t5/Splunk-Search/case-insensitive-transforms-conf/m-p/19405#M2939 <P>You put<CODE>(?i)</CODE> in your regex at the point you want it to be <A href="http://perldoc.perl.org/perlre.html#Extended-Patterns">case-insensitive</A>:</P> <PRE><CODE>REGEX=(?i):d+s([osg][host].*[abc])[wd]+s[ </CODE></PRE> <P>or:</P> <PRE><CODE>REGEX=:d+s(?i)([osg][host].*[abc])(?-i)[wd]+s[ </CODE></PRE> <P>or:</P> <PRE><CODE>REGEX=:d+s(?i:([osg][host].*[abc]))[wd]+s[ </CODE></PRE> Mon, 30 May 2011 18:57:27 GMT https://community.splunk.com/t5/Splunk-Search/case-insensitive-transforms-conf/m-p/19405#M2939 gkanapathy 2011-05-30T18:57:27Z https://community.splunk.com/t5/Splunk-Search/case-insensitive-transforms-conf/m-p/19406#M2940 <P>works like a charm, thanks</P> Mon, 30 May 2011 19:04:51 GMT https://community.splunk.com/t5/Splunk-Search/case-insensitive-transforms-conf/m-p/19406#M2940 EricPartington 2011-05-30T19:04:51Z