topic Re: How to add two REGEXes to transforms.conf? in Splunk Search

How to add two REGEXes to transforms.conf?

dmccabe2 — Mon, 16 Nov 2015 12:13:47 GMT

Hi,

I need to add two RegEx to transforms.conf and props.conf. If I add one block of code, testing each REGEX independently works.

If I duplicate the same block of code adding another REGEX, it fails.

I assume it's related to using the same variables but am uncertain.

WORKS:

  PROPS FILE: (PROPS.CONF):
  =======================
  [source::/path/to/your/access.log*]
  TRANSFORMS-null= setnull

  TRANSFORM FILE:  (transform.conf):
  ==============================
  [setnull]
  REGEX = \"GET\s\/pictures
  DEST_KEY = queue
  FORMAT = nullQueue

PROBLEM:

PROPS FILE: (PROPS.CONF):
=======================
[source::/path/to/your/access.log*]
TRANSFORMS-null= setnull

TRANSFORM FILE:  (transform.conf):
==============================
[setnull]
REGEX = \"GET\s\/t_static\/clients\/(.*)\/images
DEST_KEY = queue
FORMAT = nullQueue

Thanks,

Re: How to add two REGEXes to transforms.conf?

richgalloway — Mon, 16 Nov 2015 13:05:38 GMT

Please share examples of the strings you're trying to match.

Re: How to add two REGEXes to transforms.conf?

gyarici — Mon, 16 Nov 2015 13:42:37 GMT

Hi,

what i understood is you want to use multiple regex for similar log lines. As soon as you determined Regex1 and Regex2, you should use this structure below to have 1 regex query.

REGEX = (Regex1|Regex2) in your transform.conf

Hope it is ok.

Thanks

Gokhan

Re: How to add two REGEXes to transforms.conf?

dmccabe2 — Mon, 16 Nov 2015 14:06:52 GMT

Thak you so much I will try