All Apps and Add-ons

Handling multiple regex using Props.conf and Transforms.conf

nandipatisunil
Path Finder

What is the syntax I need to use to handle multiple regex when working with Props.conf and transforms.conf?

Also what is the syntax for if-else with in a Regex?

Any pointers would help.
Thanks.

0 Karma
1 Solution

lguinn2
Legend

Splunk uses PCRE. This is a sort of standard for regular expressions - one of many. There are dozens of resources for regular expressions, and tools to help you write them. One of my favorite reference sites is http://www.regular-expressions.info/

One beginning regular expression book that I recommend is "Sams Teach Yourself Regular Expressions" by Ben Forta. It is short, inexpensive and teaches by example.

There is no "if-then-else" per se in regular expressions. There are conditional matches, which are expressed with ?, ?= and ?<=. I am not sure that this is what you want.

Finally, I am not sure what you mean by "syntax to handle multiple regex".

What are you trying to do? With a more specific description of what you want to do, the community can probably give you a more direct answer than this one...

View solution in original post

0 Karma

lguinn2
Legend

Splunk uses PCRE. This is a sort of standard for regular expressions - one of many. There are dozens of resources for regular expressions, and tools to help you write them. One of my favorite reference sites is http://www.regular-expressions.info/

One beginning regular expression book that I recommend is "Sams Teach Yourself Regular Expressions" by Ben Forta. It is short, inexpensive and teaches by example.

There is no "if-then-else" per se in regular expressions. There are conditional matches, which are expressed with ?, ?= and ?<=. I am not sure that this is what you want.

Finally, I am not sure what you mean by "syntax to handle multiple regex".

What are you trying to do? With a more specific description of what you want to do, the community can probably give you a more direct answer than this one...

0 Karma

nandipatisunil
Path Finder

thanks lguinn. this will help.
well, on multiple regex ... i was trying to define two regex in my transforms.conf. i figured that out though.

thanks again.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...