Getting Data In

What PCRE regex can we use in our transforms.conf?




We need to ingest only those events which starts with any of the below strings ; (please note  its starts with not contains


create, drop, login, logout, alter, delete


For example

“ login success for user Peter”  

"create action success for user Martin"



we have edited the transforms.conf as below




DEST_KEY = queue

FORMAT = nullQueue



REGEX = login|logout!|create|drop|alter|DELETE

DEST_KEY = queue

FORMAT = indexQueue


But this is allowing all events which contains above strings. But our requirement is event should start with above strings;


Could you please help us with a PCRE regex for above conditions on transforms.conf?

Labels (2)
0 Karma


Hi @roopeshetty ,

the symbol for starting log is "^", so you should try  this:

REGEX = ^login|logout!|create|drop|alter|DELETE


REGEX = ^(login|logout!|create|drop|alter|DELETE)

probably the second is the orrect one.



0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...