Splunk Search

How to build a tranform which applies to a events with a field value found in a provided list

Communicator

I have a index time transform which is a bit loose in what it matches. I would like to limit it to a whitelist of indexes that I want to match against. I would very much appreciate your help with creating a clean regular expression to achieve the goal.

So I think I want REGEX = match any event with a embedded field of the form index="SomeIndexName" where SomeIndexName in (App1,App2,App3).

My current transform
[MyTransform]
REGEX=.index="(.?)"
DESTKEY=MetaData:Index
FORMAT=$1
CLEANKEYS
MV
ADD=0

0 Karma
1 Solution

Super Champion

The OR operator for regex is the pipe:

REGEX= index="(App1|App2|App3)"

I changed .index to just index because I'm not sure you need it.

View solution in original post

Super Champion

The OR operator for regex is the pipe:

REGEX= index="(App1|App2|App3)"

I changed .index to just index because I'm not sure you need it.

View solution in original post

Communicator

Yes. $1 will contain the value inside the parenthesis.

Communicator

Will $1 still contain the field value?

0 Karma