Splunk Search

transforms.conf: matching two files in regex

New Member

Hello,

I am trying to match using regex where the filenames Svc.chk and edb.chk are in Object_Name.

The following does not work...

REGEX=(?m)^Object Name:.*(edb.chk|Svc.chk)

when trying to find:

Object Name: C:\Windows\System32\LogFiles\Sum\Svc.chk

Any obvious errors here?

Many thanks

D.

0 Karma

Communicator

try this : REGEX=(?m)^Object\sName:.*(edb.chk|Svc.chk)

0 Karma

SplunkTrust
SplunkTrust

The dots before the filename extensions need to be escaped. Try this:

(?m)^Object Name:.*(edb\.chk|Svc\.chk)
---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Hello, many thanks for that - but it's still not matching I am afraid.

0 Karma