Getting Data In

What PCRE regex can we use in our transforms.conf?

roopeshetty
Path Finder

Hi

 

We need to ingest only those events which starts with any of the below strings ; (please note  its starts with not contains

 

create, drop, login, logout, alter, delete

 

For example

“ login success for user Peter”  

"create action success for user Martin"

 

 

we have edited the transforms.conf as below

 

[setnull]

REGEX = .

DEST_KEY = queue

FORMAT = nullQueue

 

[setparsing]

REGEX = login|logout!|create|drop|alter|DELETE

DEST_KEY = queue

FORMAT = indexQueue

 

But this is allowing all events which contains above strings. But our requirement is event should start with above strings;

 

Could you please help us with a PCRE regex for above conditions on transforms.conf?

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @roopeshetty ,

the symbol for starting log is "^", so you should try  this:

REGEX = ^login|logout!|create|drop|alter|DELETE

or

REGEX = ^(login|logout!|create|drop|alter|DELETE)

probably the second is the orrect one.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...