REGEX in transform.conf using "^" to specify the begining does not work

[aferchichi]

Hi,

I specified the following in transforms.conf

SOURCE_KEY = MetaData:Host
REGEX = ^8\.\d{1,3}\.\d{1,3}\.\d{1,3}$
DEST_KEY = _MetaData:Index
FORMAT = special_index

This should noramlly match host like 8.23.15.12, but it does not work. And if a remove the "^" it will match but it will also match 18.23.15.12 which I do not want. It seems that the "beging with" is not working... Is this a bug? is there a way to circumvent it?
Thanks for your help,

Azim

[nunoaragao]

Maybe not working because SOURCE_KEY = MetaData:Host will return

host::

at the begging of the string.
Maybe change REGEX to either

REGEX = ^host\:\:8\.\d{1,3}\.\d{1,3}\.\d{1,3}
REGEX = (?<!\d)8\.\d{1,3}\.\d{1,3}\.\d{1,3}

[aferchichi]

Thanks
but it does not work neither...

Any other suggestions?

Azim

[alacercogitatus]

You could try this REGEX:

^8\.\d{1,3}\.\d{1,3}\.\d{1,3}

Dropping the $ might help, since you don't really care about the end of the string, just the beginning.

[sowings]

Some of the other metadata fields have a hidden prefix of the name of the field itself, so it could be host::8.x.y.z

[aferchichi]

In fact, I think the Host variable extracted has some non viewable characters before the digits (maybe a space), that's why it did not match the "begin with 8" expression ^8.

[alacercogitatus]

I checked that regex here: http://gskinner.com/RegExr/, with these IPs:

128.3.2.4
8.4.3.2
18.3.4.5

And it only matches the 8.4.3.2 IP.

[aferchichi]

Thanks again... But here you must have something before the number "8", like a8.4.5.7 and therefore will not match the 8.4.5.7

[alacercogitatus]

[^0-9]{1,2}[^0-79]{1}\.\d{1,3}\.\d{1,3}\.\d{1,3} . Not sure why it's not picking up the "^".

[aferchichi]

Thanks but it leads to the same result... Your expression will also match 18.2.3.4 ... Which I dont want. It really seams that splunk is not capable of interpreting the begining of a string "^".

[alacercogitatus]

[^0-79]{1}\.\d{1,3}\.\d{1,3}\.\d{1,3} ?

[aferchichi]

Thanks
but it does not work neither...

Any other suggestions?

Azim