Splunk Search

need help with regex for Transforms.conf


I am new to both Splunk and REGEX. I am trying to filter out syslog data from a single src address.

I have the following in my Transforms.conf

REGEX = \[src=\]
DEST_KEY = queue
FORMAT = nullQueue

My data looks like this:

Oct  8 13:08:46 SSG550: NetScreen device_id=SSG550  [Root]system-notification-00257(traffic): start_time="2010-10-08 13:08:46" duration=0 policy_id=225 service=tcp/port:7777 proto=6 src zone=DMZ-8 dst zone=WAN action=Permit sent=0 rcvd=0 src= dst= src_port=15120 dst_port=7777 src-xlated ip= port=15120 dst-xlated ip= port=7777 session_id=250914

Isn't there some way I can select these records based on the field "src"? If not, can someone tell me why my regex above is not working.

Thanks again for helping a newbee out.

Tags (1)


If it helps at all, I found this video which explains adding lines to props.conf and transforms.conf (towards the end, first half or so is about the rex search command).


0 Karma


I'm not sure your regex syntax is correct. The "[" and "]" are special chars. You might try something like this:


Also you need to refer to this transforms.conf entry from somewhere inside of props.conf. Something like:


There's good examples of this at:


State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!