topic Re: Multiple matchs (AND) in transform.conf REGEX in Splunk Search

Multiple matchs (AND) in transform.conf REGEX

arabii — Wed, 14 Dec 2011 16:15:23 GMT

Hi,

I want to filter some events based on the occurence of multiple matchs, for instance, I want to match all (Windows) events that match (EventCode=566) AND simultanously match also (keyword=success)

Of course, I still need to do more matchs on the REGEX (Theses are working fine using the | operator), but the issue is really with doing an AND.
Any advice ?

Best regards.

Re: Multiple matchs (AND) in transform.conf REGEX

MHibbin — Wed, 14 Dec 2011 16:27:05 GMT

For filtering the events I assume you are using the method listed in this doc. And matching you events in this way.

I am a bit confused what you mean in your second point... more info please.

Re: Multiple matchs (AND) in transform.conf REGEX

arabii — Wed, 14 Dec 2011 16:37:02 GMT

I'm using the method described in the link to discard specific items and keep the remaining logs.

Below is REGEX l'm actually using:
REGEX= (?msi)^EventCode=(566|578|836|837|4662|4674|5156|4769)

I want to add somme supplementary checks for specific eventcodes like searching for another string (the search should be done only when specific eventcodes are matched)

I was planning to use REGEX like the one below but i doesn't match at all:
REGEX= (?msi)(^EventCode=(566|578|836|837|4662|4674|5156|4769))|(^EventCode=4776.Keywords=(Success))

Best regards

Re: Multiple matchs (AND) in transform.conf REGEX

the_wolverine — Tue, 14 Oct 2014 17:27:25 GMT

http://answers.splunk.com/answers/44245/regex-match-on-multiple-conditions-help.html