Escape a period in transforms regex to drop log?

[reswob4]

I'm collecting DNS logs and I'm trying to drop all logs with sub.domain.com as the query. In my transforms.conf I have the following:

[dropdomain]
REGEX = sub.domain.com
DEST_KEY=queue
FORMAT=nullQueue

But those domains still show up in my index. I have this on both the HF and the Indexer for that sourcetype.

I also am collecting logs from windows DNS debug log. As you know those come across in (#)string(#)string(#)string(#) format. So when the above comes through one of those logs, I have (3)sub(6)domain(3)com(0) in my log. I'm trying to drop those also and here is my transforms.conf for that log:

[dropdomain]
REGEX = sub(6)domain(3)com
DEST_KEY=queue
FORMAT=nullQueue

But that isn't working either. Is my syntax correct? Do I need to escape the period or not? Do I escape the parenthesis or not?

Thanks.

(I'm sure this question has been asked before, but I have not found the right google-fu to get the answer)

[reswob4 · Accepted solution]

OK, this is how I got things to work. I used:

REGEX = \[.+?\]\s+\w+\s+.+?sub.+?domain.+?com

I think I got that syntax from somewhere, but I can't find the reference....

[richgalloway]

Your syntax for both REGEX attributes is valid, but not necessarily "correct".

sub,domain.com will match "sub" followed by any character followed by "domain" followed by any character followed by "com". If you want to match dots, you need to escape them as in sub\.domain\.com.

sub(6)domain(3)com will match "sub", "6", "domain", "3", and "com" in that order and will create capture groups for '6' and '3'. To match parentheses you must escape the left paren as in sub\(6)domain\(3)com.

[reswob4]

First, thank you for the tips.

And this is where I should have reviewed my post. I actually had

sub\.domain\.com

and

sub\(6\)domain\(3\)com

but missed the reformatting changes after post.

Your answer helps. I will try both of those things.