Have Multiple REGEX in Transforms

[Scarecrowddb]

Hi All,

I was wondering how you go about sending different criteria to the null que and whether the below would work?

----tranforms.conf----

[WindowsLogonEvent675]
REGEX = (?msi)EventCode=4624.Account Name:\s(-)
REGEX = (?msi)^EventCode=(632|4719|4728|4729|4670)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

Or should the be done like below (with the same [xxxxx]?

----tranforms.conf----

[WindowsLogonEvent675]
REGEX = (?msi)EventCode=4624.Account Name:\s(-)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

----tranforms.conf----

[WindowsLogonEvent675]
REGEX = (?msi)^EventCode=(632|4719|4728|4729|4670)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

Sorry for the vague question.... but I hope someone understands what I mean...

Thanks

David

[the_wolverine]

http://answers.splunk.com/answers/44245/regex-match-on-multiple-conditions-help.html

[hulahoop · Accepted solution]

You cannot have multiple REGEX parameters in transforms.conf for the same stanza. You almost have it correct with breaking this into 2 transforms, but they need to have unique names. So here's how you would split into 2 and call them from props.conf

-----props.conf-----

[mysourcetype]
TRANSFORMS-foo = WindowsLogonEvent675_Part1, WindowsLogonEvent675_Part2

-----transforms.conf-----

WindowsLogonEvent675_Part1]
REGEX = (?msi)EventCode=4624.Account Name:\s(-)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

[WindowsLogonEvent675_Part2]
REGEX = (?msi)^EventCode=(632|4719|4728|4729|4670)
DEST_KEY = _TCP_ROUTING
FORMAT = forwardauqldrv00mgt1ai

[Scarecrowddb]

OK, thanks heaps for your help!