Splunk Search

Regex for a nullQueue multiple strings

agentguerry
Path Finder

I am trying to set a regex that works when i use say regexr.com but doesn't apply in my transforms/props file.

I am wanting to not ingest any apache logs that contain:  assets/js, assets/css, assets/img

I can set one up singular, and it works fine, but the two commented out lines, even though they work in a regex case, don't seem to apply in my transforms file.  Any insight if I may be doing something wrong?

Thank you for any assistance.

 

[drop_assets]
REGEX = .*assets\/js.*
#REGEX = .*(assets\/js|assets\/css|assets\/img).*
#REGEX = .*assets/js.*|.*assets/css.*|.*assets/img.*
DEST_KEY = queue
FORMAT = nullQueue

 

[apache]
TRANSFORMS-drop = drop_assets

Labels (2)
0 Karma
1 Solution

agentguerry
Path Finder

in the end i think i made a simple mistake of naming my stanza in my props file "apache" when my sourcetype was "ApacheAccess".  That helped me, but also, the regex above gave me the results.  Splunk seems to be able to read the escaping / "\/" also.

 

Thank you all.

View solution in original post

0 Karma

agentguerry
Path Finder

in the end i think i made a simple mistake of naming my stanza in my props file "apache" when my sourcetype was "ApacheAccess".  That helped me, but also, the regex above gave me the results.  Splunk seems to be able to read the escaping / "\/" also.

 

Thank you all.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Here's another regex to try.  Note that the leading and trailing ".*" is implied unless the "^" or "$" anchor is used.

REGEX = assets\/(?:js|css|img)
---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Also, slash ("/") doesn't need escaping.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

regex101.com says otherwise.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

regex101 highlits a lone slash as an eror because by default it considers the given regex as delimited by slashes (it's described as PHP-compatible). If you switch to Python mode, then slash will not be highlited as error, but double quotes will, since Python regexes are delimited by double quotes.

Splunk doesn't use either of those as delimiters so they don't need to be escaped.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...