Multiple matchs (AND) in transform.conf REGEX

[arabii]

Hi,

I want to filter some events based on the occurence of multiple matchs, for instance, I want to match all (Windows) events that match (EventCode=566) AND simultanously match also (keyword=success)

Of course, I still need to do more matchs on the REGEX (Theses are working fine using the | operator), but the issue is really with doing an AND.
Any advice ?

Best regards.

[the_wolverine]

http://answers.splunk.com/answers/44245/regex-match-on-multiple-conditions-help.html

[MHibbin]

For filtering the events I assume you are using the method listed in this doc. And matching you events in this way.

I am a bit confused what you mean in your second point... more info please.

[arabii]

I'm using the method described in the link to discard specific items and keep the remaining logs.

Below is REGEX l'm actually using:
REGEX= (?msi)^EventCode=(566|578|836|837|4662|4674|5156|4769)

I want to add somme supplementary checks for specific eventcodes like searching for another string (the search should be done only when specific eventcodes are matched)

I was planning to use REGEX like the one below but i doesn't match at all:
REGEX= (?msi)(^EventCode=(566|578|836|837|4662|4674|5156|4769))|(^EventCode=4776.Keywords=(Success))

Best regards