topic Re: Transforms.conf: Need help combining regex (simple)? in Splunk Search

Transforms.conf: Need help combining regex (simple)?

the_wolverine — Wed, 08 Jun 2011 19:40:58 GMT

I'm sure this is really simple but I've been unable to figure out the syntax to combine these 2 regexes in my transforms.conf. Thus, I've split them into two separate stanzas:

[first]
REGEX=(?m)(ComputerName=HerComputer)
DEST_KEY=_MetaData:Index
FORMAT=new

[second]
REGEX=(?m)(ComputerName=HisLaptop)
DEST_KEY=_MetaData:Index
FORMAT=new

Re: Transforms.conf: Need help combining regex (simple)?

ziegfried — Wed, 08 Jun 2011 19:49:47 GMT

How about this?

[combined]
REGEX=(?m)ComputerName=(HerComputer|HisLaptop)
DEST_KEY=_MetaData:Index
FORMAT=new

Re: Transforms.conf: Need help combining regex (simple)?

the_wolverine — Fri, 10 Jun 2011 05:01:41 GMT

Thanks 🙂