What's wrong with this REGEX?

[danielbb]

I have this "innocent" regex to send to the nullQueue in transforms.conf, and it doesn't work. I'm scratching my head for two days, what can this be?

REGEX = \} OnChange

[gcusello]

HI @danielbb ,

as also @livehybrid said, it's mandatory to have a sample of your logs to check your regex, even if it's very simple.

One additional question: what's the flow of your data?

To correctly work this transformation must be located in the first full Splunk instance where logs pass through, in other words in the first Heavy Forwarder.

Ciao.

Giuseppe

[livehybrid]

Hi @danielbb 

Are you able to post a sample of the event you are working with and also how you are calling the REGEX/transform?

Does this make any difference?

REGEX = \}\sOnChange

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing