Routing to 3rd party

[a212830]

Hi,

I need to route specific messages that come into Splunk to another destination via syslog. I have the props/transforms, but need help with the REGEX. I need to send any event that has "Session started" or "Session ended". Not sure how to wildcard that...

[David · Accepted solution]

A regex of (Session started|Session ended) should meet your need. You can also test things like this out at regexr.com