Splunk Search

How to write regex in transforms.conf to filter events to null queue?

andrewbeeber
Explorer

Hi everyone,

I am having difficulty filtering events via my props/transform.conf files. Below are my key stanza's from my transforms and props.conf files. My question is in regard to regular expressions. If I want to filter out something such a *NIX path like /opt/WVRTSralus/bin/beremote; do I have to replace the / with a REGEX \W
to get exe\W\W\Wopt\WVRTSralux\Wbin\Wberemote\W, as I have outlined below?

Or can I get away with REGEX = (exe=opt//opt/WVRTSralus/bin/beremote)

Transforms.conf-----

[setnull]
LOOKAHEAD = 100000
REGEX = (\Wopt\WMcAfee\W|opt\Wvmware\Wtools\W|\Wopt\WNAI\W|\Wusr\Wshare\Wlocale\W|\W\Wso|\W\Wso\W\d|\Wusr\Wshare\Wlocale\W|\Wopt\Wsplunkforwarder\W|\Whome\Wbserver\WCode\W|proc\Wnet\W|exe\W\W\Wopt\WVRTSralux\Wbin\Wberemote\W)
DEST_KEY = queue
FORMAT = nullQueue

props.conf ------

[source::/var/log/audit/audit.log]
TRANSFORMS-null=setnull
Tags (2)
0 Karma
1 Solution

lguinn2
Legend

If you want to filter on the path, then the regular expression is the path:

[setnull]
REGEX=/opt/WVRTSralus/bin/beremote
...

If you want multiples, you can use the | - I add the () for clarity

[setnull]
REGEX=(:/opt/WVRTSralus/bin/beremote)|(:/opt/splunkforwarder)
...

If your paths have \, then you need to double them \\

I am not sure why you want all the \W - nothing in the path names is being wildcarded and nothing is a special character to regex.

View solution in original post

lguinn2
Legend

If you want to filter on the path, then the regular expression is the path:

[setnull]
REGEX=/opt/WVRTSralus/bin/beremote
...

If you want multiples, you can use the | - I add the () for clarity

[setnull]
REGEX=(:/opt/WVRTSralus/bin/beremote)|(:/opt/splunkforwarder)
...

If your paths have \, then you need to double them \\

I am not sure why you want all the \W - nothing in the path names is being wildcarded and nothing is a special character to regex.

andrewbeeber
Explorer

Weird the "/" or the "\W" does not seem to render properly...

0 Karma

andrewbeeber
Explorer

Thanks Iguinn, I will try that now. I thought you needed the \W to replace the / in the path name. If that is not needed, then great.

I had tried using the regex as you initially stated, but it failed to work over the weekend and consequently, I ended up indexing 5M+ transactions over a 5 hour period. I'll try seperating each "filter" with brackets you suggest asI agree, they do help in in reading the REGEX statement.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...