Getting Data In

How do I match a specific set of numbers in transforms.conf?

mark_law
Engager

I have this in transforms.conf to match a specific subset of syslog events I'm interested in.

[setparsing]
REGEX = category=(76|12|126|218)
DEST_KEY = queue
FORMAT = indexQueue

The problem is that there are "category" events numbered 121, 124 that get matched with the REGEX I'm using, whereas I"m only interested in "12" and "126".

How can the REGEX be tighened up to allow only the specific values I want?

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Either of the following;

REGEX = category=(76|12|126|218)\b

REGEX = category=(76|12|126|218)\D

REGEX = category=(76|12|126|218)\s

should work. Will match your numbers if followed by a word boundary, non-digit and whitespace, respectively. For more info, see

http://www.regular-expressions.info

/K

0 Karma

Ayn
Legend

What characters do you have after this string? Space?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...