Splunk Search

need help with regex for Transforms.conf


I am new to both Splunk and REGEX. I am trying to filter out syslog data from a single src address.

I have the following in my Transforms.conf

REGEX = \[src=\]
DEST_KEY = queue
FORMAT = nullQueue

My data looks like this:

Oct  8 13:08:46 SSG550: NetScreen device_id=SSG550  [Root]system-notification-00257(traffic): start_time="2010-10-08 13:08:46" duration=0 policy_id=225 service=tcp/port:7777 proto=6 src zone=DMZ-8 dst zone=WAN action=Permit sent=0 rcvd=0 src= dst= src_port=15120 dst_port=7777 src-xlated ip= port=15120 dst-xlated ip= port=7777 session_id=250914

Isn't there some way I can select these records based on the field "src"? If not, can someone tell me why my regex above is not working.

Thanks again for helping a newbee out.

Tags (1)


If it helps at all, I found this video which explains adding lines to props.conf and transforms.conf (towards the end, first half or so is about the rex search command).


0 Karma


I'm not sure your regex syntax is correct. The "[" and "]" are special chars. You might try something like this:


Also you need to refer to this transforms.conf entry from somewhere inside of props.conf. Something like:


There's good examples of this at:


Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...