All Apps and Add-ons

Handling multiple regex using Props.conf and Transforms.conf

nandipatisunil
Path Finder

What is the syntax I need to use to handle multiple regex when working with Props.conf and transforms.conf?

Also what is the syntax for if-else with in a Regex?

Any pointers would help.
Thanks.

0 Karma
1 Solution

lguinn2
Legend

Splunk uses PCRE. This is a sort of standard for regular expressions - one of many. There are dozens of resources for regular expressions, and tools to help you write them. One of my favorite reference sites is http://www.regular-expressions.info/

One beginning regular expression book that I recommend is "Sams Teach Yourself Regular Expressions" by Ben Forta. It is short, inexpensive and teaches by example.

There is no "if-then-else" per se in regular expressions. There are conditional matches, which are expressed with ?, ?= and ?<=. I am not sure that this is what you want.

Finally, I am not sure what you mean by "syntax to handle multiple regex".

What are you trying to do? With a more specific description of what you want to do, the community can probably give you a more direct answer than this one...

View solution in original post

0 Karma

lguinn2
Legend

Splunk uses PCRE. This is a sort of standard for regular expressions - one of many. There are dozens of resources for regular expressions, and tools to help you write them. One of my favorite reference sites is http://www.regular-expressions.info/

One beginning regular expression book that I recommend is "Sams Teach Yourself Regular Expressions" by Ben Forta. It is short, inexpensive and teaches by example.

There is no "if-then-else" per se in regular expressions. There are conditional matches, which are expressed with ?, ?= and ?<=. I am not sure that this is what you want.

Finally, I am not sure what you mean by "syntax to handle multiple regex".

What are you trying to do? With a more specific description of what you want to do, the community can probably give you a more direct answer than this one...

0 Karma

nandipatisunil
Path Finder

thanks lguinn. this will help.
well, on multiple regex ... i was trying to define two regex in my transforms.conf. i figured that out though.

thanks again.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...