Regex to ignore [\r][\n]

[saad_siddiqi]

Hi there,

I have been trying to remove the below line which is a big part of one of the logs. Been trying with many regex types in transforms.conf but it doesn't recognize it when I a put in "[\r][\n]".

DEBUG - wire << "[\r][\n]"

I have tried many options like
"[\\r][\\n]"
"[\\r][\\n]\"
etc but still no luck.

Can anyone help me out with this.

Thanks

[sbrant_splunk · Accepted solution]

try \[\\r\]\[\\n\]

You must escape not only the backslashes but also the square brackets.

[saad_siddiqi]

Yeah, I wanted not to index the lines DEBUG - wire << "[\r][\n]"

[saad_siddiqi]

That did the trick... Cheers mate!

[sbrant_splunk]

BTW, this will match [\r][\n] but you mention "ignoring" the pattern. Do you mean that you've collected the data and you want to ignore those lines in your search results or do you mean that you'd like to not index the lines that contain that pattern?