https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-in-transforms-conf-to-filter-events-to-null/m-p/153330#M43022 <P>Hi everyone,</P> <P>I am having difficulty filtering events via my props/transform.conf files. Below are my key stanza's from my transforms and props.conf files. My question is in regard to regular expressions. If I want to filter out something such a *NIX path like <CODE>/opt/WVRTSralus/bin/beremote</CODE>; do I have to replace the / with a REGEX \W <BR /> to get exe\W\W\Wopt\WVRTSralux\Wbin\Wberemote\W, as I have outlined below?</P> <P>Or can I get away with REGEX = (exe=opt//opt/WVRTSralus/bin/beremote)</P> <P>Transforms.conf-----</P> <PRE><CODE>[setnull] LOOKAHEAD = 100000 REGEX = (\Wopt\WMcAfee\W|opt\Wvmware\Wtools\W|\Wopt\WNAI\W|\Wusr\Wshare\Wlocale\W|\W\Wso|\W\Wso\W\d|\Wusr\Wshare\Wlocale\W|\Wopt\Wsplunkforwarder\W|\Whome\Wbserver\WCode\W|proc\Wnet\W|exe\W\W\Wopt\WVRTSralux\Wbin\Wberemote\W) DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>props.conf ------</P> <PRE><CODE>[source::/var/log/audit/audit.log] TRANSFORMS-null=setnull </CODE></PRE> Mon, 06 Oct 2014 16:59:55 GMT andrewbeeber 2014-10-06T16:59:55Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-in-transforms-conf-to-filter-events-to-null/m-p/153330#M43022 <P>Hi everyone,</P> <P>I am having difficulty filtering events via my props/transform.conf files. Below are my key stanza's from my transforms and props.conf files. My question is in regard to regular expressions. If I want to filter out something such a *NIX path like <CODE>/opt/WVRTSralus/bin/beremote</CODE>; do I have to replace the / with a REGEX \W <BR /> to get exe\W\W\Wopt\WVRTSralux\Wbin\Wberemote\W, as I have outlined below?</P> <P>Or can I get away with REGEX = (exe=opt//opt/WVRTSralus/bin/beremote)</P> <P>Transforms.conf-----</P> <PRE><CODE>[setnull] LOOKAHEAD = 100000 REGEX = (\Wopt\WMcAfee\W|opt\Wvmware\Wtools\W|\Wopt\WNAI\W|\Wusr\Wshare\Wlocale\W|\W\Wso|\W\Wso\W\d|\Wusr\Wshare\Wlocale\W|\Wopt\Wsplunkforwarder\W|\Whome\Wbserver\WCode\W|proc\Wnet\W|exe\W\W\Wopt\WVRTSralux\Wbin\Wberemote\W) DEST_KEY = queue FORMAT = nullQueue </CODE></PRE> <P>props.conf ------</P> <PRE><CODE>[source::/var/log/audit/audit.log] TRANSFORMS-null=setnull </CODE></PRE> Mon, 06 Oct 2014 16:59:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-in-transforms-conf-to-filter-events-to-null/m-p/153330#M43022 andrewbeeber 2014-10-06T16:59:55Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-in-transforms-conf-to-filter-events-to-null/m-p/153331#M43023 <P>If you want to filter on the path, then the regular expression is the path:</P> <PRE><CODE>[setnull] REGEX=/opt/WVRTSralus/bin/beremote ... </CODE></PRE> <P>If you want multiples, you can use the <CODE>|</CODE> - I add the <CODE>()</CODE> for clarity</P> <PRE><CODE>[setnull] REGEX=(:/opt/WVRTSralus/bin/beremote)|(:/opt/splunkforwarder) ... </CODE></PRE> <P>If your paths have <CODE>\</CODE>, then you need to double them <CODE>\\</CODE></P> <P>I am not sure why you want all the <CODE>\W</CODE> - nothing in the path names is being wildcarded and nothing is a special character to regex.</P> Mon, 06 Oct 2014 17:51:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-in-transforms-conf-to-filter-events-to-null/m-p/153331#M43023 lguinn2 2014-10-06T17:51:44Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-in-transforms-conf-to-filter-events-to-null/m-p/153332#M43024 <P>Thanks Iguinn, I will try that now. I thought you needed the \W to replace the / in the path name. If that is not needed, then great. </P> <P>I had tried using the regex as you initially stated, but it failed to work over the weekend and consequently, I ended up indexing 5M+ transactions over a 5 hour period. I'll try seperating each "filter" with brackets you suggest asI agree, they do help in in reading the REGEX statement.</P> Mon, 06 Oct 2014 18:11:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-in-transforms-conf-to-filter-events-to-null/m-p/153332#M43024 andrewbeeber 2014-10-06T18:11:29Z https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-in-transforms-conf-to-filter-events-to-null/m-p/153333#M43025 <P>Weird the "/" or the "\W" does not seem to render properly...</P> Mon, 06 Oct 2014 19:05:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-regex-in-transforms-conf-to-filter-events-to-null/m-p/153333#M43025 andrewbeeber 2014-10-06T19:05:41Z