Getting Data In

What is the regular expression for these Event ID codes?

Explorer

Client needs to push these event codes through Heavy Forwarder to Splunk Cloud.
So please help in creating REGEX for filtering the below Event ID's in transforms.conf and props.conf
transforms.conf

1100,1101,1102,1104,1105,1108
4624-4627,4634,4646-4668,4670-4672,4675,4690-4691,4698-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797-4803
0 Karma

Splunk Employee
Splunk Employee

Hi chanamoluk,

The IDs you provided are just samples - a small subset of all the event IDs with the same patterns you want to capture, right?
If so, I think there are two primary patterns: /d{4} and /d{4}-/d{4}.

You can then filter out events with these IDs using the following example stanzas - just for your reference.

props.conf

[EventLog:System]
TRANSFORMS = null_queue_filter

transforms.conf

[null_queue_filter]
REGEX = (?m)^EventID=(/d{4}|/d{4}-/d{4})
DEST_KEY = queue
FORMAT = nullQueue

Hope this helps. Thanks!
Hunter

0 Karma

Explorer

1100,1101,1102,1104,1105,1108
4624-4627,4634,4646-4668,4670-4672,4675,4690-4691,4698-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797-4803
4817-4820,4865-4900,4902,4904-4908,4911-4913,4928-4937,4944-4952,4954,4956-4958,4964,4976,4985
5031,5063-5070,5120,5136-5145,5148-5159,5168,5376-5377,5440-5444,5446-5453,5456-5468,5471-5474,5477,5632-5633,5888-5889
6144-6145,6272-6280

This are the list of event codes data i want to send to splunk cloud and for which i need regular expressions.

please help me in creating regular expressions... help will appreciated...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!