Splunk Search

Escape a period in transforms regex to drop log?

reswob4
Builder

I'm collecting DNS logs and I'm trying to drop all logs with sub.domain.com as the query. In my transforms.conf I have the following:

[dropdomain]
REGEX = sub.domain.com
DEST_KEY=queue
FORMAT=nullQueue

But those domains still show up in my index. I have this on both the HF and the Indexer for that sourcetype.

I also am collecting logs from windows DNS debug log. As you know those come across in (#)string(#)string(#)string(#) format. So when the above comes through one of those logs, I have (3)sub(6)domain(3)com(0) in my log. I'm trying to drop those also and here is my transforms.conf for that log:

[dropdomain]
REGEX = sub(6)domain(3)com
DEST_KEY=queue
FORMAT=nullQueue

But that isn't working either. Is my syntax correct? Do I need to escape the period or not? Do I escape the parenthesis or not?

Thanks.

(I'm sure this question has been asked before, but I have not found the right google-fu to get the answer)

0 Karma
1 Solution

reswob4
Builder

OK, this is how I got things to work. I used:

REGEX = \[.+?\]\s+\w+\s+.+?sub.+?domain.+?com

I think I got that syntax from somewhere, but I can't find the reference....

View solution in original post

0 Karma

reswob4
Builder

OK, this is how I got things to work. I used:

REGEX = \[.+?\]\s+\w+\s+.+?sub.+?domain.+?com

I think I got that syntax from somewhere, but I can't find the reference....

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your syntax for both REGEX attributes is valid, but not necessarily "correct".

sub,domain.com will match "sub" followed by any character followed by "domain" followed by any character followed by "com". If you want to match dots, you need to escape them as in sub\.domain\.com.

sub(6)domain(3)com will match "sub", "6", "domain", "3", and "com" in that order and will create capture groups for '6' and '3'. To match parentheses you must escape the left paren as in sub\(6)domain\(3)com.

---
If this reply helps you, an upvote would be appreciated.

reswob4
Builder

First, thank you for the tips.

And this is where I should have reviewed my post. I actually had

sub\.domain\.com

and

sub\(6\)domain\(3\)com

but missed the reformatting changes after post.

Your answer helps. I will try both of those things.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...