What is the regular expression for these Event ID codes?

[chanamoluk]

Client needs to push these event codes through Heavy Forwarder to Splunk Cloud.
So please help in creating REGEX for filtering the below Event ID's in transforms.conf and props.conf
transforms.conf

1100,1101,1102,1104,1105,1108
4624-4627,4634,4646-4668,4670-4672,4675,4690-4691,4698-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797-4803

[hunters_splunk]

Hi chanamoluk,

The IDs you provided are just samples - a small subset of all the event IDs with the same patterns you want to capture, right?
If so, I think there are two primary patterns: /d{4} and /d{4}-/d{4}.

You can then filter out events with these IDs using the following example stanzas - just for your reference.

props.conf

[EventLog:System]
TRANSFORMS = null_queue_filter

transforms.conf

[null_queue_filter]
REGEX = (?m)^EventID=(/d{4}|/d{4}-/d{4})
DEST_KEY = queue
FORMAT = nullQueue

Hope this helps. Thanks!
Hunter

[chanamoluk]

1100,1101,1102,1104,1105,1108
4624-4627,4634,4646-4668,4670-4672,4675,4690-4691,4698-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797-4803
4817-4820,4865-4900,4902,4904-4908,4911-4913,4928-4937,4944-4952,4954,4956-4958,4964,4976,4985
5031,5063-5070,5120,5136-5145,5148-5159,5168,5376-5377,5440-5444,5446-5453,5456-5468,5471-5474,5477,5632-5633,5888-5889
6144-6145,6272-6280

This are the list of event codes data i want to send to splunk cloud and for which i need regular expressions.

please help me in creating regular expressions... help will appreciated...