writing a rex for transforms

[gurinderbhatti]

Hello All,
I would appreciate some assistance in writing a transforms stanza.
I am ingesting logs in which both the logname and one of the path directories both have random names. This is causing my source count to go through the roof. See below:

/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920647/AE_BICURCNV_1920647.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920659/AE_BICURCNV_1920659.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920665/AE_BICURCNV_1920665.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920672/AE_BICURCNV_1920672.AET
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920672/AE_BICURCNV_1920672.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920678/AE_BICURCNV_1920678.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920695/AE_BICURCNV_1920695.stdout
/appserv/prcs/FSPRD/log_output/AE_BICURCNV_1920723/AE_BICURCNV_1920723.stdout

As you can see the directory before the log file keeps on changing. I need to write a transform to ignore everything after 'AE' and then the file name.
So it almost would like the following:
/appserv/prcs/FSPRD/log_output/AE/AE.stdout

Can someone help me write the regex for my transforms base file that i can reference which would achieve this. thanks in advance.

[lukejadamec]

No. You can't do that with a regex. I mean you can create the REGEX, but it will not effect the source overload. The REGEX just tells Splunk which file to 'get'. The determination of Source is something completely different - it is automatic and it is based on the real file path.

What you really want to do is override source. Check out this doc:

http://answers.splunk.com/answers/97128/question-about-override-source-value-for-a-single-input