Splunk Search

REGEX in transform.conf using "^" to specify the begining does not work

New Member

Hi,

I specified the following in transforms.conf

SOURCE_KEY = MetaData:Host
REGEX = ^8\.\d{1,3}\.\d{1,3}\.\d{1,3}$
DEST_KEY = _MetaData:Index
FORMAT = special_index

This should noramlly match host like 8.23.15.12, but it does not work. And if a remove the "^" it will match but it will also match 18.23.15.12 which I do not want. It seems that the "beging with" is not working... Is this a bug? is there a way to circumvent it?
Thanks for your help,

Azim

0 Karma

New Member

Thanks
but it does not work neither...

Any other suggestions?

Azim

0 Karma

SplunkTrust
SplunkTrust

You could try this REGEX:

^8\.\d{1,3}\.\d{1,3}\.\d{1,3}

Dropping the $ might help, since you don't really care about the end of the string, just the beginning.

0 Karma

Splunk Employee
Splunk Employee

Some of the other metadata fields have a hidden prefix of the name of the field itself, so it could be host::8.x.y.z

0 Karma

New Member

In fact, I think the Host variable extracted has some non viewable characters before the digits (maybe a space), that's why it did not match the "begin with 8" expression ^8.

0 Karma

SplunkTrust
SplunkTrust

I checked that regex here: http://gskinner.com/RegExr/, with these IPs:

128.3.2.4
8.4.3.2
18.3.4.5

And it only matches the 8.4.3.2 IP.

0 Karma

New Member

Thanks again... But here you must have something before the number "8", like a8.4.5.7 and therefore will not match the 8.4.5.7

0 Karma

SplunkTrust
SplunkTrust

[^0-9]{1,2}[^0-79]{1}\.\d{1,3}\.\d{1,3}\.\d{1,3} . Not sure why it's not picking up the "^".

0 Karma

New Member

Thanks but it leads to the same result... Your expression will also match 18.2.3.4 ... Which I dont want. It really seams that splunk is not capable of interpreting the begining of a string "^".

0 Karma

SplunkTrust
SplunkTrust

[^0-79]{1}\.\d{1,3}\.\d{1,3}\.\d{1,3} ?

0 Karma

New Member

Thanks
but it does not work neither...

Any other suggestions?

Azim

0 Karma