What's wrong with this REGEX?

[danielbb]

I have this "innocent" regex to send to the nullQueue in transforms.conf, and it doesn't work. I'm scratching my head for two days, what can this be?

REGEX = \} OnChange

[gcusello]

HI @danielbb ,

as also @livehybrid said, it's mandatory to have a sample of your logs to check your regex, even if it's very simple.

One additional question: what's the flow of your data?

To correctly work this transformation must be located in the first full Splunk instance where logs pass through, in other words in the first Heavy Forwarder.

Ciao.

Giuseppe

[livehybrid]

Hi @danielbb 

Are you able to post a sample of the event you are working with and also how you are calling the REGEX/transform?

Does this make any difference?

REGEX = \}\sOnChange

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[danielbb]

Hi @livehybrid ,

Thank you for the great response.

It seemed to have been a simple typo on my side.

Do you know how I could rework this REGEX to work for multiple phrases (about 50 or so)?

Is it best practice to do it all in one REGEX statement or split it into multiple transforms.conf stanzas?

[PickleRick · Accepted solution]

Well, performance-wise one transform with a well-crafted regex should be faster than several dozens of separate ones. The question is whether you'll need to maintain that later because a single humongous regex can be very confusing and prone to errors on edit.

[danielbb]

That sounds great, @PickleRick how long can the REGEX string be? and is there any way to "beautify" it instead of using constant pipes "|" so it's more readable?