https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282995#M85500 <P>I suppose you could try this:<BR /> [source::(?!/opt/splunk/var/).../*]</P> Wed, 17 Feb 2016 09:14:19 GMT johannes88 2016-02-17T09:14:19Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282992#M85497 <P>Hello,</P> <P>We would like to match all sources except the ones including <CODE>/splunk/</CODE> in props.conf.</P> <P>Example: No match for <CODE>/opt/splunk/var/log/splunk/metrics.log</CODE> and <CODE>/opt/splunk/var/log/splunk/splunkd.log</CODE></P> <P>We tried several regex variations, but without luck...</P> <P>Thanks,<BR /> Rainer</P> Tue, 16 Feb 2016 17:11:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282992#M85497 rainerzufall 2016-02-16T17:11:40Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282993#M85498 <P>What are you trying to achieve here? Are you trying to do a field extraction OR event filter OR something else? </P> Tue, 16 Feb 2016 17:43:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282993#M85498 somesoni2 2016-02-16T17:43:38Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282994#M85499 <P>we would like to implement index routing for all events but internal Splunk logs.</P> Wed, 17 Feb 2016 08:38:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282994#M85499 rainerzufall 2016-02-17T08:38:40Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282995#M85500 <P>I suppose you could try this:<BR /> [source::(?!/opt/splunk/var/).../*]</P> Wed, 17 Feb 2016 09:14:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282995#M85500 johannes88 2016-02-17T09:14:19Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282996#M85501 <P>You should have the stanza match the source, not have a regex in the props.conf stanza. So the stanza should be something like <CODE>[source::/opt/splunk/var/log/splunk/*]</CODE></P> <P>If you want to see more examples have a look at your btool output - <CODE>$SPLUNK_HOME/splunk cmd btool props list | grep 'source::'</CODE></P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf">http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf</A> and search the page for source:: for more details. If you're still having trouble post the relevant props and transforms stanzas here - you might have a different problem than the pattern matching</P> Wed, 17 Feb 2016 10:40:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282996#M85501 jplumsdaine22 2016-02-17T10:40:59Z https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282997#M85502 <P>Thanks! That did the trick...</P> Wed, 17 Feb 2016 14:50:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-configure-REGEX-in-a-props-conf-source-stanza-to-match/m-p/282997#M85502 rainerzufall 2016-02-17T14:50:38Z