Load regex from file

[pugnacity]

hi,

currently we use as a central syslog server with logcheck. every hour the server will generate a mail with messages that do not fit to a regex. the same would i do now with splunk and a custom dashboard, but how can i load the regex files into splunk?

[hazekamp]

Would it be possible to add an anonymized sample event(s) to your use case?

[vaijpc]

I get the impression that you would have to do a little more work than 'just' "load the regex files"?

I can't see this being easier than working through the regexes and creating new searches/reports based on them to reimplement the same end report?

Perhaps it would be an idea to take each existing regex and implement an eventtype for it in splunk. Then, run a search/generate a report on messages that don't have the uninteresting (successful) eventtypes?