https://community.splunk.com/t5/Splunk-Search/regex-forwarder/m-p/34875#M7597 <P>I don't think this is exactly what you want. Some parts of the regex that you are showing seem unnecessary, and some are wrong... Try this:</P> <PRE><CODE>REGEX=\scomm=sendmail\s </CODE></PRE> <P>The other lines appear correct to me.</P> Thu, 15 Dec 2011 00:11:15 GMT lguinn2 2011-12-15T00:11:15Z https://community.splunk.com/t5/Splunk-Search/regex-forwarder/m-p/34874#M7596 <P>I am new to regex - so......</P> <P>I want to filter out all events that contain the word sendmail</P> <P>My messages look like the following</P> <P>type=SYSCALL msg=audit(12/13/2011 05:41:01.898:11192536) : arch=x86_64 syscall=unlink success=yes exit=0 a0=2afe55cbc340 a1=2afe60dea7a6 a2=2afe55cbc352 a3=2afe55cbc340 items=2 ppid=5655 pid=5656 auid=unset uid=root gid=smmsp euid=root suid=root fsuid=root egid=smmsp sgid=smmsp fsgid=smmsp tty=(none) ses=4294967295 comm=sendmail exe=/usr/sbin/sendmail.sendmail key=(null)</P> <P>This is what I have in my transforms.conf</P> <PRE><CODE>[auditdNullsendmail] # filter auditd, multiline, comm=sendmail REGEX=(?ms)^comm=sendmail.+exe=/usr/sbin DEST_KEY=queue FORMAT=nullQueue </CODE></PRE> <P>Does this look like it will work?</P> <P>When I search for sendmail in realtime - I am seeing events come in, but they are from the past (like Splunk is catching up???) </P> Wed, 14 Dec 2011 15:25:55 GMT https://community.splunk.com/t5/Splunk-Search/regex-forwarder/m-p/34874#M7596 mcbradford 2011-12-14T15:25:55Z https://community.splunk.com/t5/Splunk-Search/regex-forwarder/m-p/34875#M7597 <P>I don't think this is exactly what you want. Some parts of the regex that you are showing seem unnecessary, and some are wrong... Try this:</P> <PRE><CODE>REGEX=\scomm=sendmail\s </CODE></PRE> <P>The other lines appear correct to me.</P> Thu, 15 Dec 2011 00:11:15 GMT https://community.splunk.com/t5/Splunk-Search/regex-forwarder/m-p/34875#M7597 lguinn2 2011-12-15T00:11:15Z